How to Determine The Date-And-Time That a Linux Process Was Started

How to get the start time of a long-running Linux process?

You can specify a formatter and use lstart, like this command:

ps -eo pid,lstart,cmd

The above command will output all processes, with formatters to get PID, command run, and date+time started.

Example (from Debian/Jessie command line)

$ ps -eo pid,lstart,cmd
  PID CMD                                          STARTED
    1 Tue Jun  7 01:29:38 2016 /sbin/init                  
    2 Tue Jun  7 01:29:38 2016 [kthreadd]                  
    3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]               
    5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]              
    7 Tue Jun  7 01:29:38 2016 [rcu_sched]                 
    8 Tue Jun  7 01:29:38 2016 [rcu_bh]                    
    9 Tue Jun  7 01:29:38 2016 [migration/0]               
   10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                 
   11 Tue Jun  7 01:29:38 2016 [netns]                     
  277 Tue Jun  7 01:29:38 2016 [writeback]                 
  279 Tue Jun  7 01:29:38 2016 [crypto]                    
      ...

You can read ps's manpage or check Opengroup's page for the other formatters.

How to determine the date-and-time that a Linux process was started?

I have a project on github that does this in perl. You can find it here:

https://github.com/cormander/psj

The code you're wanting is in lib/Proc/PID.pm, and here is the snippit (with comments removed):

use POSIX qw(ceil sysconf _SC_CLK_TCK);

sub _start_time {
    my $pid = shift->pid;

    my $tickspersec = sysconf(_SC_CLK_TCK);

    my ($secs_since_boot) = split /\./, file_read("/proc/uptime");
    $secs_since_boot *= $tickspersec;

    my $start_time = (split / /, file_read("/proc/$pid/stat"))[21];

    return ceil(time() - (($secs_since_boot - $start_time) / $tickspersec));
}

Beware the non-standard code function file_read in here, but that should be pretty straight forward.

Linux Command History with date and time

Regarding this link you can make the first solution provided by krzyk permanent by executing:

echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
source ~/.bash_profile

Parsing process start time from linux ps command output in c#

The ps command can be asked to present specific data, and in some cases in specific formats, which can make it easier to parse the results. You request specific data with the -o command line option, whose argument is a comma-separated list of items in the form: item=HEADER. HEADER is the column header to use; leaving it out means that no header will be printed for that column (but if you also leave out the =, you'll get a default header).

There are at least two common items for start time: start and lstart. These give you the standard and long versions of the time, respectively:

$ ps -ostart= 2875
11:28:13
$ ps -olstart= 2875
Wed Mar 18 11:28:13 2015

On Linux, ps gets its information from the "file" /proc/pid/stat, which is a single line containing space-separated fields (see man 5 proc). The start time is the 22nd item in the list; it is an integer, which represents the number of clock ticks since the system was booted. In bash, you can convert this to something more usable with a bit of work:

start_time() {
  local now running ticks uptime
  now=$(date +%s)            # time in seconds since epoch
  running=$(cut -d' ' -f22 /proc/$1/stat)
                             # start time of process in ticks since boot
  ticks=$(getconf CLK_TCK)   # ticks per second (usually 100)
  uptime=($(</proc/uptime))  # seconds since boot and idle time
  bc <<<"$now-${uptime[0]}+$running/$ticks"
}

$ date +"%Y-%m-%d %H:%M:%S" -d@$(start_time 2875)
2015-03-18 11:28:12

How to get time in seconds since process started, without using etimes?

For process of pid 1234, you could use the mtime field of meta-data of pseudo-file /proc/1234/status. Read proc(5) for more.
See also stat(2) and stat(1) and date(1).

So date +%s is giving the current date since the Unix epoch, e.g. 1479125355 now in November 14^th, 2016. stat -c %Y /proc/1234/status is giving the start time of process 1234 since Unix epoch. You want the difference. Perhaps use (barely tested, my interactive shell is zsh)
$[$(date +%s) - $(stat -c %Y /proc/1234/status)]; adapt that to your shell.

For example:

 bash -c 'sleep 4; echo $(($(date +%s) - $(stat -c %Y /proc/$$/status)))'

is giving me 4 as expected. Of course the $$ is expanded to the pid of the bash -c command

---

Related Topics