Sunday, September 21, 2008

How to get the process start date and time

How can we determine when a running process was started?

The venerable ps command deserves first consideration.

Most Linux command-line users are familiar with either the standard UNIX notation or the BSD notation when it comes to specifying ps options.

If ps -ef is what you use, that is the UNIX notation.

$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Sep20 ? 00:00:03 init [3]

peter 1218 1 0 Sep20 ? 00:21:35 /usr/lib/iceweasel/firefox-bin -a firefox

peter 4901 1 1 16:34 ? 00:01:12 /usr/bin/emacs-snapshot-gtk


The STIME column displays the start time or date. From the above, we can tell that process 4901 (emacs) began execution at 16:34 (4:34 pm). But on what day, today?

From the ps man page: 'Only the year will be displayed if the process was not started the same year ps was invoked, or "mmmdd" if it was not started the same day, or "HH:MM" otherwise.'

So, emacs was started at 16:34 TODAY.

What is the start time for the other process, the firefox process with pid 1218?

The STIME for process 1218 reads Sep20 (which was yesterday). But what time yesterday?

The default ps -ef only tells you the start date but NOT the time if a process was NOT started on the same day.

If the BSD notation is more familiar to you, you will find that ps aux yields similar results.

$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 1576 540 ? Ss Sep20 0:03 init[3]

peter 1218 0.5 8.9 201252 45456 ? Sl Sep20 21:35 /usr/lib/iceweasel/firefox-bin -a firefox


The Start column in the above output only reveals the start date if the process is older than the current day.

There are (at least) 2 ways to determine the exact start time if the process was started before the current day.

Solution 1
Specify elapsed time in the ps output format.

$ ps -eo pid,cmd,etime
PID CMD ELAPSED
1218 /usr/lib/iceweasel/firefox-bin - 2-16:04:45


The above ps command specifies 3 fields to be included in the output: the process pid, the command, and the elapsed time, respectively.

etime is the elapsed time since the process was started, in the form dd-hh:mm:ss. dd is the number of days; hh, the number of hours; mm, the number of minutes; ss, the number of seconds.

The firefox command started execution 2 days, 16 hours, 4 minutes and 45 seconds ago. To find the exact time, you need to do some simple math.

If you prefer the BSD notation, issue this command:
$ ps axo pid,cmd,etime
PID CMD ELAPSED

1218 /usr/lib/iceweasel/firefox-bin - 2-16:04:57


Solution 2
Get the process pid and read off the timestamp in the corresponding subdirectory in /proc.

First, get the process pid using the ps command (ps -ef or ps aux)

Then, use the ls command to display the creation timestamp of the directory.
$ ls -ld /proc/1218
dr-xr-xr-x 5 peter peter 0 Sep 20 16:14 /proc/1218


You can tell from the timestamp that the process 1218 began executing on Sept 20, 16:14.

If you can think of another clever way to get the start time and date, please let us know.

18 comments:

Anonymous said...

This post was really useful to me.
Thanks for sharing your knowledge.

Greetings from Argentina,

Mariano

Unknown said...

another simple way to know process start time:

ps -eo pid,lstart,cmd

enjoy

Anonymous said...

Looking at the mtime of /proc/PID may not yield useful results. For example on my PC most entries changed their time today at 19:29 for some reason.
But using the elapsed time still works - or the lstart format option to ps as sujeet suggested.

Vincent Reydet said...

If you want the timestamp :

date -d "`ps -p __PID__ -o lstart=`" +'%s'

totedati said...

quote:
"sujeet said...

another simple way to know process start time:

ps -eo pid,lstart,cmd"

lol! indeed sujeet suggestion is complete and excelent! look at this output:

ps -eo pid,lstart,cmd | grep ps
1418 Mon Jun 1 15:49:19 2009 [khpsbpkt]
1454 Mon Jun 1 15:49:19 2009 [kpsmoused]
12547 Mon Jun 1 15:50:02 2009 dcopserver [kdeinit] --nosid
16642 Sun Jun 7 03:50:58 2009 ps -eo pid,lstart,cmd
16643 Sun Jun 7 03:50:58 2009 grep --colour=auto ps

Anonymous said...

actually, using 'ps' on linux is not always reliable. i've seen situations where 'ps' can return different start time for a given process with subsequent invocations. the difference is usually 1 second (probably a rounding error). it's more reliable to use

proc /proc/{PID}/stat | awk '{print $22}'
this will give start time in jiffies since last system reboot.

0perations said...

The process start time drift you've seen in ps is probably related to this:
https://bugzilla.redhat.com/show_bug.cgi?id=518730

Due to the way that the start time of a process is calculated by ps (/proc/stat btime + /proc/PID/stat jiffies since process start) when NTP adjusts the system clock forward over time the start time of long running processes drifts.

Unknown said...

The timestamp of the /proc/pid file is changed under certain conditions. Example: using Ubuntu 10.4 the timestamps are updated once a day by some cron job. It's possible to change the timestamp by just 'touching' the directory.

Unknown said...

i want to display the process created date & time only in Unix ?

Anyone Know Just Give post your answer

Thanks And Regards

Dhandayuthabani

Unknown said...

Great post. Thanks especially for the /proc/pid

Gabriel said...

Great post , It really helped me , thank you

Erikson De León said...

Great bro, your post helped me

Kapil Awadhwal said...

Thank you sooo much for this informative post...

Unknown said...

You can achieve the same with: ps axo pid,user,cmd,lstart

infroma said...

Thank you for this post, I've got what I needed, but Solution #2 is not a solution actually, because it sometimes gives wrong results:

$ ls -ld --full-time /proc/23555
dr-xr-xr-x 8 irv tenso 0 2016-02-04 12:00:55.005137889 +0300 /proc/23555/
$ ps -eo pid,lstart,cmd | grep 23555
23555 Thu Feb 4 12:00:00 2016 ffmpeg -i rtsp://10.2.8.2:554/axis-media/media.amp -r 30 -c copy -t 3616 -strftime 1 video//10.2.8.2_2016.02.04_12:00:00.mp4

I suggest you to remove it.

reichhart said...

The solution with the proc directory is wrong because it's updated frequently.

You can calculate the start time by the (already mentioned) jiffies since boot time.
If you want an easy-to-use binary for this purpose you can use "lps" of the package ngtx:
http://www.tuxad.com/download-ngtx.html

lps prints the "age" of processes at the start of the line to give you the ability of using "sort -n" to order processes by "age".

murali said...

Thanks for the topic...very much useful for beginners..
i used this commands in my development phase. after reading this.

Anonymous said...

Cool info! Too bad elapsed isn't a default column ... nice!


ps -eo pid,cmd,etime