[merpkz]

could achieve something similar a bit different way - by using Linux nftables ( new iptables ) netfilter interface. I have setup like this for measuring used traffic by certain daemons running under specific user:

  table inet raw {
  ...
   counter postgre_tcp_traffic_out {
     packets 0 bytes 0
   }
  ...
   chain output {
    ...
    meta l4proto tcp skuid postgres counter name "postgre_tcp_traffic_out" notrack
    ...
   }
  }

and then view it like this:

  nft -j list counters | jq '.'
  ...
        "counter": {
          "family": "inet",
          "name": "postgre_tcp_traffic_out",
          "table": "raw",
          "handle": 20,
          "packets": 255,
          "bytes": 17694
        }
  ...

Since nft -j outputs JSON it can easily then be ingested back into Postgres and indexed. I personally use it together with zabbix to count per second differences in values. It needs some more work because netfilter can match packets by UID/GID only for output, input then has to be matched by destination port, 5432 in case of postgres.

[Self-Perfection]

Nice. I had another approach in mind but never actually implemented.

Systemd seems to report.network traffic stats for managed units. It spawns cgroups for units which among other things track network traffic.

[burmecia]

That's a nice approach, thanks for sharing with us.