Problem
Is it feasible to obtain the start time of a previously ran process? If it wasn’t begun today, ps appears to report the date (not the time) and merely the year if it wasn’t started this year. Is the precision of previous procedures forever lost?
Asked by ajwood
Solution #1
You can use lstart with a formatter specified, such as this command:
ps -eo pid,lstart,cmd
All processes will be printed with formatters to retrieve PID, command ran, and date+time started with the above command.
Example (command line in Debian/Jessie)
$ ps -eo pid,lstart,cmd
PID CMD STARTED
1 Tue Jun 7 01:29:38 2016 /sbin/init
2 Tue Jun 7 01:29:38 2016 [kthreadd]
3 Tue Jun 7 01:29:38 2016 [ksoftirqd/0]
5 Tue Jun 7 01:29:38 2016 [kworker/0:0H]
7 Tue Jun 7 01:29:38 2016 [rcu_sched]
8 Tue Jun 7 01:29:38 2016 [rcu_bh]
9 Tue Jun 7 01:29:38 2016 [migration/0]
10 Tue Jun 7 01:29:38 2016 [kdevtmpfs]
11 Tue Jun 7 01:29:38 2016 [netns]
277 Tue Jun 7 01:29:38 2016 [writeback]
279 Tue Jun 7 01:29:38 2016 [crypto]
...
Other formatters can be found in ps’s manpage or on Opengroup’s page.
Answered by 逆さま
Solution #2
The ps command (at least the procps version used by many Linux editions) provides a number of format features related to the process start time, including lstart, which always returns the complete date and time the process began:
# ps -p 1 -wo pid,lstart,cmd
PID STARTED CMD
1 Mon Dec 23 00:31:43 2013 /sbin/init
# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER PID %CPU %MEM VSZ RSS TT STAT STARTED CMD
root 1 0.0 0.1 2800 1152 ? Ss Mon Dec 23 00:31:44 2013 /sbin/init
root 5151 0.3 0.1 4732 1980 pts/2 S Sat Mar 8 16:50:47 2014 bash
See https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running for further details on how the information is published in the /proc filesystem.
(In my experience with Linux, the time stamp on the /proc/ folders appears to be connected to a recent access to the virtual directory rather than the process start time:
# date; ls -ld /proc/1 /proc/$$
Sat Mar 8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151
Note that I ran a “ps -p 1” command at 16:50, then spawned a new bash shell, and then ran the “ps -p 1 -p $$” command within that shell shortly after….)
Answered by Nathan
Solution #3
As a follow-up to Adam Matan’s response, the time stamp in the /proc/pid> directory isn’t always useful, but you can use it.
awk -v RS=')' 'END{print $20}' /proc/12345/stat
to retrieve the start time since the system boot in clock ticks 1
This is a slightly difficult unit to work with; for more information, see convert jiffies to seconds.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat
This should return seconds, which you can use to create a (human-readable or otherwise) timestamp using strftime().
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat
Thanks to Stephane Chazelas for some helpful suggestions in the comments; as usual, thanks!
Try Mawk if you only have Mawk.
awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
NR==1 { now=$1; next }
END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d @{}
1 man proc; look for a starting time.
Answered by tripleee
Solution #4
ls -ltrh /proc | grep YOUR-PID-HERE
My Google Chrome’s PID, for example, is 11583:
ls -l /proc | grep 11583
dr-xr-xr-x 7 adam adam 0 2011-04-20 16:34 11583
Answered by Adam Matan
Solution #5
ps -eo pid,cmd,lstart | grep YOUR-PID-HERE
Answered by Stackoverflow
Post is based on https://stackoverflow.com/questions/5731234/how-to-get-the-start-time-of-a-long-running-linux-process