Is it possible to get the start time of an old running process? It seems that ps
will report the date (not the time) if it wasn't started today, and only the year if it wasn't started this year. Is the precision lost forever for old processes?
You can specify a formatter and use lstart
, like this command:
ps -eo pid,lstart,cmd
The above command will output all processes, with formatters to get PID, command run, and date+time started.
Example (from Debian/Jessie command line)
$ ps -eo pid,lstart,cmd
PID CMD STARTED
1 Tue Jun 7 01:29:38 2016 /sbin/init
2 Tue Jun 7 01:29:38 2016 [kthreadd]
3 Tue Jun 7 01:29:38 2016 [ksoftirqd/0]
5 Tue Jun 7 01:29:38 2016 [kworker/0:0H]
7 Tue Jun 7 01:29:38 2016 [rcu_sched]
8 Tue Jun 7 01:29:38 2016 [rcu_bh]
9 Tue Jun 7 01:29:38 2016 [migration/0]
10 Tue Jun 7 01:29:38 2016 [kdevtmpfs]
11 Tue Jun 7 01:29:38 2016 [netns]
277 Tue Jun 7 01:29:38 2016 [writeback]
279 Tue Jun 7 01:29:38 2016 [crypto]
...
You can read ps
's manpage or check Opengroup's page for the other formatters.
-
3@bobbyrne01: change the order, e.g. pid,etime,cmd works for me on Debian Wheezy. – exic Jan 14 '14 at 8:50
-
2
-
4for completeness, for those used to BSD syntax:
ps axo pid,cmd,lstart
also works – Graeme Moss Oct 12 '16 at 7:50 -
2
-
1Be aware that
lstart
time can change, thestat
methods below are safer - unix.stackexchange.com/questions/274610/…. – slm Jun 20 '19 at 15:13
The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart
which always gives the full date and time the process started:
# ps -p 1 -wo pid,lstart,cmd
PID STARTED CMD
1 Mon Dec 23 00:31:43 2013 /sbin/init
# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER PID %CPU %MEM VSZ RSS TT STAT STARTED CMD
root 1 0.0 0.1 2800 1152 ? Ss Mon Dec 23 00:31:44 2013 /sbin/init
root 5151 0.3 0.1 4732 1980 pts/2 S Sat Mar 8 16:50:47 2014 bash
For a discussion of how the information is published in the /proc filesystem, see https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running
(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:
# date; ls -ld /proc/1 /proc/$$
Sat Mar 8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151
Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)
-
To see every process (not just your own) add an
e
(standardps
syntax) orax
(BSD syntax) argument to the ps command: i.e.ps -ewo pid,lstart,cmd
orps -axwo pid,lstart,cmd
– Ryan Griffith Feb 3 '16 at 13:50
As a follow-up to Adam Matan's answer, the /proc/<pid>
directory's time stamp as such is not necessarily directly useful, but you can use
awk -v RS=')' 'END{print $20}' /proc/12345/stat
to get the start time in clock ticks since system boot.1
This is a slightly tricky unit to use; see also convert jiffies to seconds for details.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat
This should give you seconds, which you can pass to strftime()
to get a (human-readable, or otherwise) timestamp.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat
Updated with some fixes from Stephane Chazelas in the comments; thanks as always!
If you only have Mawk, maybe try
awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
NR==1 { now=$1; next }
END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d @{}
1 man proc; search for starttime.
-
Slightly refactored for production use: gist.github.com/tripleee/2a1622fdf8ab080ce3b36d95af60010a – tripleee Aug 17 '16 at 6:23
-
1Bear in mind that the
strftime()
andsystime()
aren't present inmawk
, which is the defaultawk
in my Debian 8 VPS images, so I can only assume that they're specific togawk
's dialect. – ssokolow Feb 24 '17 at 9:11
ls -ltrh /proc | grep YOUR-PID-HERE
For example, my Google Chrome's PID is 11583:
ls -l /proc | grep 11583
dr-xr-xr-x 7 adam adam 0 2011-04-20 16:34 11583
-
6This does not work for me - it prints modification time (changes frequently) Maybe because of this: unix.stackexchange.com/questions/20460/… – user920391 Oct 28 '14 at 22:11
-
-
1This returned a time 9 minutes later than when a process I have information about had actually started. – Dan Dascalescu Jun 5 '17 at 1:14
-
1This seems to be my only option that works, though maybe not reliable. I'm on an embedded system that only has busybox
ps
which saysinvalid option
for all the options mentioned by other answers. – Qi Fan Sep 7 '17 at 21:11 -
8Why
grep
? Why notls -ldh /proc/$pid
? Or even better,date -r /proc/$pid
? – Caesar Oct 25 '18 at 0:56
ps -eo pid,cmd,lstart | grep YOUR-PID-HERE
-
1
ps -p <pid> -o lstart
? Seems like it works, but I'm not sure why it's not the immediate obvious answer for the many times this question seems to come up. – ajwood Apr 20 '11 at 16:07ps -p <pid> -o lstart=
to avoid additional line (header) to be printed. – Vladimir Protasov Jan 15 '14 at 15:27ps -p <pid> -o lstart
? Maybe the fact there's nolstart
neither in 2004 Edition nor in 2013 Edition of POSIX 1003.1 standard? – Piotr Dobrogost Mar 6 '14 at 14:21