Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've found a nice monitor which allows me to log a variety of runtime data of a single process. I'm looking for an equivalent that does the same for bandwidth usage. Ideally, the command should look like bwmon --pid 1 --log init.log. Is there such? Can it run without admin privileges?

share|improve this question
1  
related: superuser.com/questions/189128/… –  akira Feb 4 '11 at 20:08

3 Answers 3

up vote 3 down vote accepted

something to get you started (just in case you want to write it yourself):

#!/bin/bash
#
# usage: bwmon PID

IN=0; OUT=0; TIME=0

get_traffic() {
    t=`awk '/eth0:/ { printf("%s,%d,%d\n",strftime("%s"),$2,$10); }' < /proc/$1/net/dev`
    IN=${t#*,}; IN=${IN%,*}
    OUT=${t##*,};
    TIME=${t%%,*};
}

get_traffic $1
while true
do
    _IN=$IN; _OUT=$OUT; _TIME=$TIME
    get_traffic $1
    echo "$TIME,$(( $TIME - $_TIME )),$IN,$(( $IN - $_IN )),$OUT,$(( $OUT - $_OUT))"
    sleep 1
done

comments:

  • checks only eth0
  • checks every 1 second
  • works only under linux, but other unixes work similar (procfs or whatever)
  • output could be stored into a sqlite.db with stat --printf="%N\n" /proc/PID/exe | cut -d ' ' -f 3
share|improve this answer
    
Works quite nicely. Thanks. –  Tshepang Feb 4 '11 at 20:19
2  
I don't think this is actually a per-process counter; I think it's just the total interface count from the process' point of view. I ran a client/server nc pair over localhost, sending one byte per second, and watched /proc/<listening-nc-pid>/net/dev. Then I ran a second nc pair, sending at maximum rate. The file I was watching very obviously counted the second pair's data along with the first pair's. Running on Linux 2.6.32. –  Jander Feb 5 '11 at 8:33
    
I had an error function strftime never defined; it was fixed by installing gawk. –  Tshepang Mar 3 '11 at 11:12
    
@Jander That's correct, /proc/<pid>/net/dev and /proc/net/dev have the same content here. Hence the scipt only reports the traffic for eth0, not for the given process. –  scai Aug 17 '12 at 10:58

try nethogs:

NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process. NetHogs does not rely on a special kernel module to be loaded. If there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this. This makes it easy to indentify programs that have gone wild and are suddenly taking up your bandwidth.
share|improve this answer
    
Sadly, it can't monitor a single process, and it doesn't log. The second requirement (logging) is much more important that the first one though. Oh, and it doesn't run without admin privileges :( –  Tshepang Feb 4 '11 at 19:25
    
You'll almost certainly need root privileges for this. –  Falmarri Feb 5 '11 at 11:34
    
You could try using nethogs with the -t flag (tracemode). The resulting output could then be parsed to extract the traffic of the single process you're interested in. –  Valerio Schiavoni Apr 3 at 9:32

If you're satisfied with general I/O bandwidth used (or if your program does almost entirely network I/O), then you could watch the /proc/<pid>/io file. You want the rchar and wchar fields. You might want to subtract read_bytes and write_bytes, since they represent reads and writes to the storage layer. See section 3.3 of http://www.kernel.org/doc/Documentation/filesystems/proc.txt.

If you need more resolution.... you could maybe script this using lsof and strace, though it would be painful to get all the corner cases right. The basic idea is to parse the output of strace -p <pid>, grabbing the first parameter (= the file descriptor) and the return value (= number of bytes) from read(), write(), send(), and recv() calls (NOTE there are several more syscalls to listen for; I haven't tracked them all down). Discard negative values; they indicate errors. Use lsof -p <pid> to figure out which file descriptors are TCP/UDP sockets, and add up the counts per fd. This strategy doesn't require root as long as you own the process you're inspecting, but it would be really hairy to write, let alone write well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.