Coder Perfect

How can I find out when a long-running Linux process started?


Is it feasible to obtain the start time of a previously ran process? If it wasn’t begun today, ps appears to report the date (not the time) and merely the year if it wasn’t started this year. Is the precision of previous procedures forever lost?

Asked by ajwood

Solution #1

You can use lstart with a formatter specified, such as this command:

ps -eo pid,lstart,cmd

All processes will be printed with formatters to retrieve PID, command ran, and date+time started with the above command.

Example (command line in Debian/Jessie)

$ ps -eo pid,lstart,cmd
  PID CMD                                          STARTED
    1 Tue Jun  7 01:29:38 2016 /sbin/init                  
    2 Tue Jun  7 01:29:38 2016 [kthreadd]                  
    3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]               
    5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]              
    7 Tue Jun  7 01:29:38 2016 [rcu_sched]                 
    8 Tue Jun  7 01:29:38 2016 [rcu_bh]                    
    9 Tue Jun  7 01:29:38 2016 [migration/0]               
   10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                 
   11 Tue Jun  7 01:29:38 2016 [netns]                     
  277 Tue Jun  7 01:29:38 2016 [writeback]                 
  279 Tue Jun  7 01:29:38 2016 [crypto]                    

Other formatters can be found in ps’s manpage or on Opengroup’s page.

Answered by 逆さま

Solution #2

The ps command (at least the procps version used by many Linux editions) provides a number of format features related to the process start time, including lstart, which always returns the complete date and time the process began:

# ps -p 1 -wo pid,lstart,cmd
  PID                  STARTED CMD
    1 Mon Dec 23 00:31:43 2013 /sbin/init

# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER       PID %CPU %MEM    VSZ   RSS TT       STAT                  STARTED CMD
root         1  0.0  0.1   2800  1152 ?        Ss   Mon Dec 23 00:31:44 2013 /sbin/init
root      5151  0.3  0.1   4732  1980 pts/2    S    Sat Mar  8 16:50:47 2014 bash

See for further details on how the information is published in the /proc filesystem.

(In my experience with Linux, the time stamp on the /proc/ folders appears to be connected to a recent access to the virtual directory rather than the process start time:

# date; ls -ld /proc/1 /proc/$$ 
Sat Mar  8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151

Note that I ran a “ps -p 1” command at 16:50, then spawned a new bash shell, and then ran the “ps -p 1 -p $$” command within that shell shortly after….)

Answered by Nathan

Solution #3

As a follow-up to Adam Matan’s response, the time stamp in the /proc/pid> directory isn’t always useful, but you can use it.

awk -v RS=')' 'END{print $20}' /proc/12345/stat

to retrieve the start time since the system boot in clock ticks 1

This is a slightly difficult unit to work with; for more information, see convert jiffies to seconds.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
    END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat

This should return seconds, which you can use to create a (human-readable or otherwise) timestamp using strftime().

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
    END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat

Thanks to Stephane Chazelas for some helpful suggestions in the comments; as usual, thanks!

Try Mawk if you only have Mawk.

awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
  NR==1 { now=$1; next }
  END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d @{}

1 man proc; look for a starting time.

Answered by tripleee

Solution #4

ls -ltrh /proc | grep YOUR-PID-HERE

My Google Chrome’s PID, for example, is 11583:

ls -l /proc | grep 11583
dr-xr-xr-x  7 adam       adam                     0 2011-04-20 16:34 11583

Answered by Adam Matan

Solution #5

    ps -eo pid,cmd,lstart | grep YOUR-PID-HERE

Answered by Stackoverflow

Post is based on