Skip to Content

Network Tracking

QuickBox Pro uses vnStat to record per-interface network traffic. vnStat is the data source behind the bandwidth charts on the System Dashboard, the network throughput tiles in the metric strip, and the historical bandwidth graphs you can scrub through over time. It ships pre-installed and starts collecting on first boot.

This page describes the auto-heal layer that keeps vnStat’s tracked interface set aligned with your server’s actual network topology — automatically, without manual reconfiguration.

Why this matters

vnStat only counts bytes for interfaces it has been told to track. If you bond two NICs, add a bridge, swap a network card, or remove a VLAN, the kernel’s interface set changes — and any stale entries vnStat is still tracking will stop reporting while your new aggregate interface is missing entirely. Auto-heal closes that gap on its own.


Key features

Topology-aware

Detects when bond, bridge, team, or VLAN-aggregate interfaces appear or disappear and reconciles vnStat to match

Three trigger sources

Kernel netlink events, NetworkManager up/down transitions, and a systemd path watcher as a defense-in-depth fallback

Coalesced runs

Rapid back-to-back events during a NetworkManager flap are debounced so you don't get repeated reconcile passes

Aggregate-preferred

When a bond, bridge, or team is present, the reconciler tracks the aggregate rather than the underlying member NICs to avoid double-counting

Manual override

Rebuild on demand from the dashboard's Network Stats panel or with a single CLI command

Journal-logged

Every reconcile pass writes to the system journal so you can audit topology changes and any failures


What auto-heal does for you

When your server’s network topology changes — adding a bond, creating a bridge for VM traffic, joining a team, removing an old VLAN — vnStat’s tracked interface list updates on its own:

  1. The new aggregate interface is registered with vnStat so the bandwidth chart picks up data on the next collection cycle.
  2. Stale entries — interfaces that no longer exist or have been superseded by an aggregate — are removed so they stop showing up empty in the dashboard.
  3. The vnStat daemon is restarted once at the end of the pass to load the updated tracking set. No partial state, no double restarts.

The end result: the dashboard’s network charts keep working after topology changes without you having to touch a config file or remember a CLI invocation.

Aggregate vs. member counting

When a bond or bridge is present, the reconciler tracks the aggregate (e.g., bond0) and unregisters its underlying member NICs (e.g., eno1, eno2). The kernel already counts traffic on the aggregate; tracking the members in parallel would double-count it.


What triggers a re-tracking pass

Auto-heal listens on three independent signal sources so it works on every distro QuickBox Pro supports, regardless of which network management stack the host uses.

TriggerFires whenRole
Kernel netlink (udev)
A bond, bridge, or team interface is added or removed at the kernel level
Primary trigger — the source of truth for interface lifecycle events on every modern Linux kernel
NetworkManager dispatcher
NetworkManager brings a bond, bridge, team, or VLAN-bridge up or down
Catches up/down transitions on NM-managed distros where the interface becomes useable slightly after the kernel registers it
systemd path watcher
Files under /proc/net/bonding or entries in /sys/class/net change
Defense-in-depth fallback. Coalesces concurrent triggers via a built-in rate limit

All three converge on the same one-shot service. systemd handles deduplication, so a single topology change that fires more than one trigger still produces one reconcile pass.

Physical NICs are intentionally not tracked individually

Auto-heal does not react to plain physical interfaces appearing or disappearing (the eth*, ens*, enp*, or wlan* families). Those are tied to driver load and the host’s hardware — not topology you reconfigure day-to-day. When you build an aggregate on top of them, that’s the event that triggers reconciliation.


Coalescing and debouncing

When NetworkManager flaps during boot or during a network restart, several events can land within a few seconds. To prevent repeated reconcile passes, the systemd path-watcher unit caps how often it fires — a short stream of back-to-back events results in a single reconcile pass, not twenty. You won’t see your journal filled with reconcile noise during NIC churn.


Manual rebuild

There are situations where you might want to force a reconcile pass on demand — after hand-editing vnstat.conf, after rebuilding network configuration outside QuickBox, or while troubleshooting why an expected interface isn’t showing in the bandwidth chart.

You have two options:

  1. Dashboard — From the System Dashboard, find the Network Stats panel and click Rebuild interfaces.
  2. CLI — Run qb manage vnstat --rebuild directly on the server.

Both paths invoke the same reconciler. Output is logged to the system journal regardless of which path you used.

CLI subcommands

--rebuild

Reconcile the tracked interface set against current topology. Removes stale entries, adds the preferred interface if missing, and restarts vnStat once if any change was applied. This is also the default when no flag is given.

--dry-run

Show what the reconciler would do without applying any changes. Useful when you want to verify what's about to happen before committing to a restart.

--status

Print the detected aggregate interface, the detected default-route interface, the preferred tracking target, and the interfaces currently registered in vnStat's database. No changes are made.

Example invocations:

# Reconcile tracked interfaces now qb manage vnstat --rebuild # Inspect the plan without applying anything qb manage vnstat --dry-run # Show the current detection + registration state qb manage vnstat --status
Other vnstat helpers

The qb-vnstat helper exposes a few additional database-level commands you can run as needed — for example qb-vnstat —backup-database, qb-vnstat —database-size, qb-vnstat —generate-report, and qb-vnstat —clear-database. These touch the vnStat database directly rather than the tracking set, so they’re independent of auto-heal.


Diagnostics — what’s in the journal

The reconciler logs every pass to the system journal under the unit name qbx-vnstat-reconcile.service. To inspect:

# Most recent reconcile activity journalctl -u qbx-vnstat-reconcile.service -n 50 # Follow live as topology changes happen journalctl -u qbx-vnstat-reconcile.service -f # Everything since last boot journalctl -u qbx-vnstat-reconcile.service -b

A healthy pass shows the detected preferred interface, the planned add/remove list, the applied actions, and a “reconcile complete” line. If no changes were needed because the tracking set already matches the topology, the unit logs an “in sync” line and exits cleanly.


Best practices

Do

  • Trust the auto-heal — when you bond NICs or add a bridge, let vnStat resync on its own and verify the new aggregate shows up in the bandwidth chart on the next collection cycle
  • Use qb manage vnstat --dry-run before --rebuild when troubleshooting so you can see the planned changes ahead of applying them
  • Run qb manage vnstat --status if you're unsure which interface vnStat is currently counting — it shows both the detected topology and what's registered
  • Check journalctl -u qbx-vnstat-reconcile.service after a major network change if the dashboard's bandwidth chart looks wrong

Don't

  • Don't manually vnstat --add or vnstat --remove interfaces in parallel with auto-heal — let the reconciler manage the tracking set so you don't end up double-counting on an aggregate
  • Don't disable the qbx-vnstat-reconcile unit if you've configured bonding, bridges, or teams — the bandwidth chart will stop reflecting topology changes
  • Don't rely on vnstat --iflist to see what's tracked — that command lists all kernel-visible interfaces, not what vnStat has registered. Use qb manage vnstat --status instead

FAQ

No. The auto-heal layer detects topology changes through kernel netlink events, NetworkManager transitions, and a systemd path watcher, and re-registers vnStat's tracking set automatically. The new aggregate appears in the bandwidth chart on the next collection cycle.
First run qb manage vnstat --status on the server to see what's currently detected and registered. If the expected interface is detected but not registered, run qb manage vnstat --rebuild to force a reconcile pass. If it's not detected at all, the kernel doesn't see it as a bond, bridge, or team aggregate — check your network configuration.
Run qb manage vnstat --status on the server. The output includes the detected aggregate, the detected default-route interface, the preferred tracking target, and the full list of interfaces vnStat has registered.
Only when the tracking set actually changes. If a reconcile pass determines vnStat is already in sync with the current topology, it logs an in-sync message and exits without restarting the daemon.
No. It prefers a single aggregate interface (bond, bridge, or team) when one is present, falling back to the default-route NIC if no aggregate exists. The reasoning is that aggregates already account for the traffic on their member NICs at the kernel level — registering members in parallel would double-count.
The systemd path-watcher applies a built-in rate limit to coalesce rapid-fire trigger events. A short burst of back-to-back changes results in a single reconcile pass, not one per event. You won't see repeated reconcile noise in the journal during NIC churn.
The systemd journal under qbx-vnstat-reconcile.service. Use journalctl -u qbx-vnstat-reconcile.service -n 50 to see recent activity or -f to follow live.

Join the Community

Media server operators sharing configs, getting support, and shaping the future of QuickBox Pro.

Dedicated Support
Feature Previews
Community Configs
Active Discussions
Join Discord Server
Last updated on