Darkstat is a great tool for monitorin traffic on your debian linux webserver. It is easy to use and as a well formated webinterface which you can put on your own monitor such as a graphical maillog.

Install darkstat

sudo apt-get install darkstat

Configure darkstat

Before we can use darkstat, we have to configure it. But it is very easy and takes less time to configure than most other tools.

Open the init.cfg which is located on my debian linux in

vim /etc/darkstat/init.cfg

darkstat demo configuration


# Turn this to yes when you have configured the options below.
START_DARKSTAT=yes

# Don't forget to read the man page.

# You must set this option, else darkstat may not listen to
# the interface you want
INTERFACE="-i eth1"

DIR="/var/lib/darkstat"
PORT="-p 666"
#BINDIP="-b 127.0.0.1"
#LOCAL="-l 192.168.0.0/255.255.255.0"

# File will be relative to $DIR:
#DAYLOG="--daylog darkstat.log"

# Don't reverse resolve IPs to host names
DNS="--no-dns"

#FILTER="not (src net 192.168.0 and dst net 192.168.0)"

# Additional command line Arguments:
# OPTIONS="--syslog --no-macs"

Start darkstat service

sudo service darkstat start

Check darkstat service

You can check if the darkstat service is online or offline via

service darkstat status

Restart darkstat

if darkstat service is already running we can it restart as follows:

sudo service darkstat restart

View darkstat

Open darkstat in a browser via http://localhost:666/ or http://SERVER-IP_ODER_NAME:666/

Known issuses

12849: warning: bind(„127.0.0.1“) failed: Address already in use
12849: error: was not able to bind any ports for http interface

6992: warning: bind(„0.0.0.0“) failed: Address already in use
6992: warning: bind(„::“) failed: Address already in use
6992: error: was not able to bind any ports for http interface

Try to set the port „666“ to an other port. Perhaps 8000.

If you have other issues put them in the comments