Time process started linux

Linux Commando

Initially a Linux command-line interface blog, it has evolved to cover increasingly more GUI app topics. Instead of just giving you information like some man page, I illustrate their usage in real-life scenarios.

Search This Blog

Sunday, September 21, 2008

How to get the process start date and time

How can we determine when a running process was started?

The venerable ps command deserves first consideration.

Most Linux command-line users are familiar with either the standard UNIX notation or the BSD notation when it comes to specifying ps options.

If ps -ef is what you use, that is the UNIX notation.

The STIME column displays the start time or date. From the above, we can tell that process 4901 (emacs) began execution at 16:34 (4:34 pm). But on what day, today?

From the ps man page: ‘Only the year will be displayed if the process was not started the same year ps was invoked, or «mmmdd» if it was not started the same day, or «HH:MM» otherwise.’

So, emacs was started at 16:34 TODAY.

What is the start time for the other process, the firefox process with pid 1218?

The STIME for process 1218 reads Sep20 (which was yesterday). But what time yesterday?

The default ps -ef only tells you the start date but NOT the time if a process was NOT started on the same day.

If the BSD notation is more familiar to you, you will find that ps aux yields similar results.

The Start column in the above output only reveals the start date if the process is older than the current day.

There are (at least) 2 ways to determine the exact start time if the process was started before the current day.

Solution 1
Specify elapsed time in the ps output format.

The above ps command specifies 3 fields to be included in the output: the process pid, the command, and the elapsed time, respectively.

etime is the elapsed time since the process was started, in the form dd-hh:mm:ss. dd is the number of days; hh , the number of hours; mm , the number of minutes; ss , the number of seconds.

The firefox command started execution 2 days, 16 hours, 4 minutes and 45 seconds ago. To find the exact time, you need to do some simple math.

If you prefer the BSD notation, issue this command:

Solution 2
Get the process pid and read off the timestamp in the corresponding subdirectory in /proc .

First, get the process pid using the ps command ( ps -ef or ps aux )

Then, use the ls command to display the creation timestamp of the directory.

You can tell from the timestamp that the process 1218 began executing on Sept 20, 16:14.

If you can think of another clever way to get the start time and date, please let us know.

19 comments:

This post was really useful to me.
Thanks for sharing your knowledge.

Greetings from Argentina,

another simple way to know process start time:

ps -eo pid,lstart,cmd

January 29, 2009 at 10:49 PM Anonymous said.

Looking at the mtime of /proc/PID may not yield useful results. For example on my PC most entries changed their time today at 19:29 for some reason.
But using the elapsed time still works — or the lstart format option to ps as sujeet suggested.

March 18, 2009 at 12:27 PM Vincent Reydet said.

If you want the timestamp :

date -d «`ps -p __PID__ -o lstart=`» +’%s’

another simple way to know process start time:

ps -eo pid,lstart,cmd»

lol! indeed sujeet suggestion is complete and excelent! look at this output:

ps -eo pid,lstart,cmd | grep ps
1418 Mon Jun 1 15:49:19 2009 [khpsbpkt]
1454 Mon Jun 1 15:49:19 2009 [kpsmoused]
12547 Mon Jun 1 15:50:02 2009 dcopserver [kdeinit] —nosid
16642 Sun Jun 7 03:50:58 2009 ps -eo pid,lstart,cmd
16643 Sun Jun 7 03:50:58 2009 grep —colour=auto ps

June 6, 2009 at 5:54 PM Anonymous said.

actually, using ‘ps’ on linux is not always reliable. i’ve seen situations where ‘ps’ can return different start time for a given process with subsequent invocations. the difference is usually 1 second (probably a rounding error). it’s more reliable to use

proc /proc//stat | awk ‘‘
this will give start time in jiffies since last system reboot.

The process start time drift you’ve seen in ps is probably related to this:
https://bugzilla.redhat.com/show_bug.cgi?id=518730

Due to the way that the start time of a process is calculated by ps (/proc/stat btime + /proc/PID/stat jiffies since process start) when NTP adjusts the system clock forward over time the start time of long running processes drifts.

The timestamp of the /proc/pid file is changed under certain conditions. Example: using Ubuntu 10.4 the timestamps are updated once a day by some cron job. It’s possible to change the timestamp by just ‘touching’ the directory.

+1 for @sujeet solution

i want to display the process created date & time only in Unix ?

Anyone Know Just Give post your answer

Thanks And Regards

Great post. Thanks especially for the /proc/pid

May 10, 2013 at 2:08 AM Gabriel said.

Great post , It really helped me , thank you

Great bro, your post helped me

February 3, 2014 at 2:52 PM Kapil Awadhwal said.

Thank you sooo much for this informative post.

You can achieve the same with: ps axo pid,user,cmd,lstart

Thank you for this post, I’ve got what I needed, but Solution #2 is not a solution actually, because it sometimes gives wrong results:

$ ls -ld —full-time /proc/23555
dr-xr-xr-x 8 irv tenso 0 2016-02-04 12:00:55.005137889 +0300 /proc/23555/
$ ps -eo pid,lstart,cmd | grep 23555
23555 Thu Feb 4 12:00:00 2016 ffmpeg -i rtsp://10.2.8.2:554/axis-media/media.amp -r 30 -c copy -t 3616 -strftime 1 video//10.2.8.2_2016.02.04_12:00:00.mp4

I suggest you to remove it.

The solution with the proc directory is wrong because it’s updated frequently.

You can calculate the start time by the (already mentioned) jiffies since boot time.
If you want an easy-to-use binary for this purpose you can use «lps» of the package ngtx:
http://www.tuxad.com/download-ngtx.html

lps prints the «age» of processes at the start of the line to give you the ability of using «sort -n» to order processes by «age».

Thanks for the topic. very much useful for beginners..
i used this commands in my development phase. after reading this.

August 31, 2017 at 2:10 AM Anonymous said.

Cool info! Too bad elapsed isn’t a default column . nice!

Источник

How to check how long a process has been running?

I would like to avoid doing this by launching the process from a monitoring app.

10 Answers 10

On Linux with the ps from procps(-ng) (and most other systems since this is specified by POSIX):

Where $$ is the PID of the process you want to check. This will return the elapsed time in the format [[dd-]hh:]mm:ss .

Using -o etime tells ps that you just want the elapsed time field, and the = at the end of that suppresses the header (without, you get a line which says ELAPSED and then the time on the next line; with, you get just one line with the time).

Or, with newer versions of the procps-ng tool suite (3.3.0 or above) on Linux or on FreeBSD 9.0 or above (and possibly others), use:

(with an added s ) to get time formatted just as seconds, which is more useful in scripts.

On Linux, the ps program gets this from /proc/$$/stat , where one of the fields (see man proc ) is process start time. This is, unfortunately, specified to be the time in jiffies (an arbitrary time counter used in the Linux kernel) since the system boot. So you have to determine the time at which the system booted (from /proc/stat ), the number of jiffies per second on this system, and then do the math to get the elapsed time in a useful format.

It turns out to be ridiculously complicated to find the value of HZ (that is, jiffies per second). From comments in sysinfo.c in the procps package, one can A) include the kernel header file and recompile if a different kernel is used, B) use the posix sysconf() function, which, sadly, uses a hard-coded value compiled into the C library, or C) ask the kernel, but there’s no official interface to doing that. So, the ps code includes a series of kludges by which it determines the correct value. Wow.

So it’s convenient that ps does that all for you. 🙂

As user @336_ notes, on Linux (this is not portable), you can use the stat command to look at the access, modification, or status change dates for the directory /proc/$$ (where again $$ is the process of interest). All three numbers should be the same, so

will give you the time that process $$ started, in seconds since the epoch. That still isn’t quite what you want, since you still need to do the math to subtract that from the current time to get elapsed time — I guess something like date +%s —date=»now — $( stat -c%X /proc/$$ ) seconds» would work, but it’s a bit ungainly. One possible advantage is that if you use the long-format output like -c%x instead of -c%X , you get greater resolution than whole-number seconds. But, if you need that, you should probably use process-auditing approach because the timing of running the stat command is going to interfere with accuracy.

Источник

How to get the start time of a long-running Linux process?

Is it possible to get the start time of an old running process? It seems that ps will report the date (not the time) if it wasn’t started today, and only the year if it wasn’t started this year. Is the precision lost forever for old processes?

-o lstart ? Seems like it works, but I’m not sure why it’s not the immediate obvious answer for the many times this question seems to come up.

-o lstart= to avoid additional line (header) to be printed.

-o lstart ? Maybe the fact there’s no lstart neither in 2004 Edition nor in 2013 Edition of POSIX 1003.1 standard?

7 Answers 7

You can specify a formatter and use lstart , like this command:

The above command will output all processes, with formatters to get PID, command run, and date+time started.

Example (from Debian/Jessie command line)

You can read ps ‘s manpage or check Opengroup’s page for the other formatters.

The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart which always gives the full date and time the process started:

(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:

Note that in this case I ran a «ps -p 1» command at about 16:50, then spawned a new bash shell, then ran the «ps -p 1 -p $$» command within that shell shortly afterward. )

Источник

How to find uptime of a linux process

How do I find the uptime of a given linux process.

gives me a whole lot of information which includes the time at which the process was started. I am specifically looking for switch which returns the uptime of a process in milliseconds.

8 Answers 8

As «uptime» has several meanings, here is a useful command.

This command lists all processes with several different time-related columns. It has the following columns:

PID = Process ID
first COMMAND = only the command name without options and without arguments
STARTED = the absolute time the process was started
ELAPSED = elapsed time since the process was started (wall clock time), format [[dd-]hh:]mm:ss TIME = cumulative CPU time, «[dd-]hh:mm:ss» format
second COMMAND = again the command, this time with all its provided options and arguments

If you have a limited version of ps such as is found in busybox , you can get the process start time by looking at the timestamp of /proc/

. For example, if the pid you want to look at is 55.

. and then compare it with the current date.

I think you can just run:

1234 being the process id.

example with two processes started at the same hour minute seconds but not the same milliseconds:

yes, too old and yet too hard stuff. I tried with the above proposed «stat» method but what if I had «touch»-ed the PID proc dir yesterday? This means my year-old process is shown with yesterday’s time stamp. Nah, not what I need 🙁

In the newer ones, it’s simple:

as simple as that. Time is present in seconds. Do whatever you need it for. With some older boxes, situation is harder, since there’s no etimes. One could rely on:

which look a «a bit» weird since it’s in dd-hh:mm:ss format. Not suitable for further calculation. I would have preferred it in seconds, hence I used this one:

Источник

Linux — How do I see when a process started?

How can I see when a process started, assuming I know the pid. (On Linux)

6 Answers 6

If you want only the start time, you can select the field and suppress the header by doing this:

the output will look like this:

which is ctime(3) format and you can parse it to split out the relevant parts.

Other start fields such as start , stime , bsdstart and start_time age the time (after 24 hours only the date is shown, for example).

You can, however, use them directly for recently started processes without further parsing:

which would output something like:

awk ‘‘ /proc/$pid/stat — gives you the start time in jiffies after boot

«ps -f» — it’s in the man pages

If there’s a single process with a given name (e.g. openvpn ) on the host, you can do:

Following Dennis Williamson’s excellent answer, the ps command also has the -O option which, according to the man page: is «Like -o, but preloaded with some default columns.» This allows you to grep for the command (program) associated with the PID, if you don’t know the PID itself.

Example: finding when an apt-get process hanging on Debian/Ubuntu started:

Piping to grep -v grep filters out lines containing the string «grep», which removes the command we just typed in (since we don’t want it).

On my system right now, this gives:

one way you can ps -f |grep

as you said you the pid otherwise you can see in top also

Источник