How to Monitor Server Bandwidth Usage
Monitor server transfer volume with durable interface history such as vnStat, use live tools to investigate traffic, and compare the provider’s actual billing meter separately. cPanel covers selected account categories, not every byte. Alerts must match the billing period, units and counted direction; raw counters reset and a spike alone does not prove abuse.
For server and hosting-account owners comparing traffic history with billed usage, with durable counters, scope checks and alerts that survive resets.
knowledge
- Read time
- 4 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What to measure: bits, bytes and direction
Two numbers get mixed up. Bandwidth is capacity, measured in megabits per second. Usage is volume, measured in gigabytes per month. A 1 Gbps port can still burn through a monthly allowance in a day.
- Install it:
sudo apt update && sudo apt install vnstat, thensudo systemctl enable --now vnstat. - Find the real interface name:
ip -br a. Modern Ubuntu uses names like ens3 or enp1s0, not eth0. - Read the summary:
vnstat -i ens3, thenvnstat -i ens3 -dfor days and-mfor months. - Find the worst day:
vnstat -i ens3 -t. That day usually explains the month. - Watch a live rate from the same database:
vnstat -i ens3 --live.
You know it is recording when the rx and tx totals move after an hour of traffic. If they stay at zero, the interface name is wrong or the service is not running; check systemctl status vnstat.
iftop shows which host pairs are moving data; nethogs shows which process is doing it. Run both for a minute during a spike and you usually have the answer.
Check cPanel Bandwidth per domain
cPanel’s Bandwidth report covers selected account traffic, not every network byte the provider may bill. Its documented SMTP measurement records sent mail, not received POP3 or IMAP traffic. Confirm the host’s invoice meter separately.
- The report’s refresh interval and coverage depend on the host’s statistics configuration; it is not universally rebuilt only once a day.
- The per-domain rows add up to the account total. A single addon domain can be the whole spike.
- Bandwidth is not disk usage. A full disk is a separate page, and the fix is different.
- Check statistics availability and processing before treating an empty report as proof of zero traffic.
Write the month-to-date figure down before you change anything. That baseline is how you prove the fix worked at the end of the month.
Set an alert before the cap
Set server usage alerts from durable billing-period totals, not raw counters that reset on reboot. Confirm units and whether the allowance counts inbound, outbound or combined traffic before comparing measurements.
- Read the allowance, billing period and units from the actual service terms.
- Use provider alerts where available, and review their recipients and threshold.
- Use vnStat history or a verified provider meter for durable local trend monitoring.
- Test alert delivery through an authorised test, then restore the chosen threshold.
- Ensure alerts suppress duplicate messages and remain meaningful across resets and interface changes.
A simple rx_bytes plus tx_bytes cron calculation is lifetime-since-reset volume, not monthly billed usage. It can also confuse GiB and decimal GB and repeatedly mail the same alert. This guide therefore does not present that broken calculation as a monthly monitor.
What a spike usually means
A bandwidth spike is a signal to investigate, not a diagnosis by itself. Compare interface history, provider totals, application logs and process activity to identify the likely source.
| Pattern | Likely cause | Check first |
|---|---|---|
| Same hour every night | Backup, sync or log shipping | crontab -l and the backup schedule |
| One domain outbound, flat and high | Hotlinked image, video or a scraper | Access log top URLs and referrers |
| Inbound roughly equals outbound | rsync or offsite copy | nethogs process list |
| Many short connections, mail ports | Compromised mailbox or spam relay | Exim queue and mail log |
| Unexpected sustained traffic and many sources | Possible traffic surge, bots or abuse; not proven by a fixed rate | Correlate provider telemetry, logs and legitimate demand before action |
| Slow rise across weeks | Real growth, or a crawler you never blocked | cPanel per-domain totals and analytics |
A number alone cannot tell you whether to optimise or upgrade. The per-domain and per-process view turns the spike into a name, and a name has a fix.
Cut usage before you buy more bandwidth
Most spikes are cheaper to remove than to host. Work down this list before you change plan, because extra allowance hides the same fault at a higher price.
- Enable page caching and compression. On LiteSpeed, the LSCache plugin removes most repeat PHP work and the bytes that come with it.
- Recompress large images to WebP and serve the right size. A 2 MB hero image on every page is bandwidth you chose to send.
- Move video and large downloads to object storage or a CDN, so the web server stops carrying them.
- Block hotlinking in .htaccess, and rate-limit login and API endpoints that bots hammer.
- Upgrade only when the traffic is clean and still near the cap. A VPS or cloud plan is quoted by email before payment when that day comes.
For the definitions behind these numbers, the bandwidth explainer covers the difference between capacity and volume. If the disk is filling at the same time, start with freeing disk space on Linux, because a full disk stops logs and can hide the traffic cause.
Frequently asked questions
What is the fastest way to check bandwidth usage on Linux?
Install vnstat and run vnstat -i with the interface name from ip -br a. It shows the current month and day totals in one screen, and it keeps history across reboots unlike the raw kernel counters.
Why does vnstat show zero traffic?
Check that vnstatd is running and monitoring the selected interface, that traffic has occurred and that the database has had time to collect it. Interface changes, permissions or missing historical data are also possible. Zero output does not identify one cause by itself.
Where is bandwidth shown in cPanel?
Open Metrics → Bandwidth where the host exposes it, then inspect the period and traffic categories. Refresh timing and coverage depend on server configuration. The report is not a substitute for the provider’s complete billing meter; received POP3 and IMAP mail are not counted in its documented SMTP total.
Why did bandwidth jump without a traffic increase?
Check backups, sync jobs and mail first; they run without visitors. Then look for a hotlinked file or a scraper in the access log. A per-domain jump with flat analytics is usually bots or abuse.
Does a CDN reduce server bandwidth?
Yes for static files, images and video, which stop hitting your server once cached. API calls, form posts and downloads still count, so a CDN will not fix a spike caused by those.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.