Is it possible to get the start time of an old running process? It seems that ps
will report the date (not the time) if it wasn't started today, and only the year if it wasn't started this year. Is the precision lost forever for old processes?
8 Answers
You can specify a formatter and use lstart
, like this command:
ps -eo pid,lstart,cmd
The above command will output all processes, with formatters to get PID, command run, and date+time started.
Example (from Debian/Jessie command line)
$ ps -eo pid,lstart,cmd
PID CMD STARTED
1 Tue Jun 7 01:29:38 2016 /sbin/init
2 Tue Jun 7 01:29:38 2016 [kthreadd]
3 Tue Jun 7 01:29:38 2016 [ksoftirqd/0]
5 Tue Jun 7 01:29:38 2016 [kworker/0:0H]
7 Tue Jun 7 01:29:38 2016 [rcu_sched]
8 Tue Jun 7 01:29:38 2016 [rcu_bh]
9 Tue Jun 7 01:29:38 2016 [migration/0]
10 Tue Jun 7 01:29:38 2016 [kdevtmpfs]
11 Tue Jun 7 01:29:38 2016 [netns]
277 Tue Jun 7 01:29:38 2016 [writeback]
279 Tue Jun 7 01:29:38 2016 [crypto]
...
You can read ps
's manpage or check Opengroup's page for the other formatters.
-
3@bobbyrne01: change the order, e.g. pid,etime,cmd works for me on Debian Wheezy.– exicJan 14, 2014 at 8:50
-
4
-
5for completeness, for those used to BSD syntax:
ps axo pid,cmd,lstart
also works Oct 12, 2016 at 7:50 -
2
-
1Be aware that
lstart
time can change, thestat
methods below are safer - unix.stackexchange.com/questions/274610/….– slmJun 20, 2019 at 15:13
The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart
which always gives the full date and time the process started:
# ps -p 1 -wo pid,lstart,cmd
PID STARTED CMD
1 Mon Dec 23 00:31:43 2013 /sbin/init
# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER PID %CPU %MEM VSZ RSS TT STAT STARTED CMD
root 1 0.0 0.1 2800 1152 ? Ss Mon Dec 23 00:31:44 2013 /sbin/init
root 5151 0.3 0.1 4732 1980 pts/2 S Sat Mar 8 16:50:47 2014 bash
For a discussion of how the information is published in the /proc filesystem, see https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running
(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:
# date; ls -ld /proc/1 /proc/$$
Sat Mar 8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151
Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)
-
To see every process (not just your own) add an
e
(standardps
syntax) orax
(BSD syntax) argument to the ps command: i.e.ps -ewo pid,lstart,cmd
orps -axwo pid,lstart,cmd
Feb 3, 2016 at 13:50
As a follow-up to Adam Matan's answer, the /proc/<pid>
directory's time stamp as such is not necessarily directly useful, but you can use
awk -v RS=')' 'END{print $20}' /proc/12345/stat
to get the start time in clock ticks since system boot.1
This is a slightly tricky unit to use; see also convert jiffies to seconds for details.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat
This should give you seconds, which you can pass to strftime()
to get a (human-readable, or otherwise) timestamp.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat
Updated with some fixes from Stephane Chazelas in the comments; thanks as always!
If you only have Mawk, maybe try
awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
NR==1 { now=$1; next }
END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d @{}
1 man proc; search for starttime.
-
Slightly refactored for production use: gist.github.com/tripleee/2a1622fdf8ab080ce3b36d95af60010a– tripleeeAug 17, 2016 at 6:23
-
1Bear in mind that the
strftime()
andsystime()
aren't present inmawk
, which is the defaultawk
in my Debian 8 VPS images, so I can only assume that they're specific togawk
's dialect.– ssokolowFeb 24, 2017 at 9:11
ls -ltrh /proc | grep YOUR-PID-HERE
For example, my Google Chrome's PID is 11583:
ls -l /proc | grep 11583
dr-xr-xr-x 7 adam adam 0 2011-04-20 16:34 11583
-
6This does not work for me - it prints modification time (changes frequently) Maybe because of this: unix.stackexchange.com/questions/20460/… Oct 28, 2014 at 22:11
-
-
1This returned a time 9 minutes later than when a process I have information about had actually started. Jun 5, 2017 at 1:14
-
2This seems to be my only option that works, though maybe not reliable. I'm on an embedded system that only has busybox
ps
which saysinvalid option
for all the options mentioned by other answers.– Qi FanSep 7, 2017 at 21:11 -
11Why
grep
? Why notls -ldh /proc/$pid
? Or even better,date -r /proc/$pid
?– CaesarOct 25, 2018 at 0:56
$ ps -p 182454 -o lstart=
Mon Oct 18 17:26:44 2021
But can I get the answer in epoch seconds?
-
Not sure if ps can report that directly, but depending on your environment you can maybe use command substitution to convert it:
date --date="$(ps -p 182454 -o lstart=)" '+%s'
– ajwoodOct 18, 2021 at 16:34
ps -eo pid,cmd,lstart | grep YOUR-PID-HERE
-
1
use the command ls -ld /proc/process_id where process_id can be find using top command
-
This just repeats information from older answers, without the caveats.– tripleeeJul 22, 2022 at 20:23
ps -p <pid> -o lstart
? Seems like it works, but I'm not sure why it's not the immediate obvious answer for the many times this question seems to come up.ps -p <pid> -o lstart=
to avoid additional line (header) to be printed.ps -p <pid> -o lstart
? Maybe the fact there's nolstart
neither in 2004 Edition nor in 2013 Edition of POSIX 1003.1 standard?