How can we determine when a running process was started?
The venerable
ps command deserves first consideration.
Most Linux command-line users are familiar with either the standard UNIX notation or the BSD notation when it comes to specifying
ps options.
If
ps -ef is what you use, that is the UNIX notation.
$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Sep20 ? 00:00:03 init [3]
peter 1218 1 0 Sep20 ? 00:21:35 /usr/lib/iceweasel/firefox-bin -a firefox
peter 4901 1 1 16:34 ? 00:01:12 /usr/bin/emacs-snapshot-gtk
The
STIME column displays the start time or date. From the above, we can tell that process 4901 (emacs) began execution at 16:34 (4:34 pm). But on what day, today?
From the
ps man page: 'Only the year will be displayed if the process was not started the same year
ps was invoked, or "mmmdd" if it was not started the same day, or "HH:MM" otherwise.'
So, emacs was started at 16:34 TODAY.
What is the start time for the other process, the firefox process with pid 1218?
The
STIME for process 1218 reads Sep20 (which was yesterday). But what time yesterday?
The default
ps -ef only tells you the start date but NOT the time if a process was NOT started on the same day.
If the BSD notation is more familiar to you, you will find that
ps aux yields similar results.
$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 1576 540 ? Ss Sep20 0:03 init[3]
peter 1218 0.5 8.9 201252 45456 ? Sl Sep20 21:35 /usr/lib/iceweasel/firefox-bin -a firefox
The
Start column in the above output only reveals the start date if the process is older than the current day.
There are (at least) 2 ways to determine the exact start time if the process was started before the current day.
Solution 1Specify elapsed time in the ps output format.
$ ps -eo pid,cmd,etime
PID CMD ELAPSED
1218 /usr/lib/iceweasel/firefox-bin - 2-16:04:45
The above
ps command specifies 3 fields to be included in the output: the process
pid, the command, and the elapsed time, respectively.
etime is the elapsed time since the process was started, in the form dd-hh:mm:ss.
dd is the number of days;
hh, the number of hours;
mm, the number of minutes;
ss, the number of seconds.
The firefox command started execution 2 days, 16 hours, 4 minutes and 45 seconds ago. To find the exact time, you need to do some simple math.
If you prefer the BSD notation, issue this command:
$ ps axo pid,cmd,etime
PID CMD ELAPSED
1218 /usr/lib/iceweasel/firefox-bin - 2-16:04:57
Solution 2Get the process
pid and read off the timestamp in the corresponding subdirectory in
/proc.
First, get the process
pid using the
ps command (
ps -ef or
ps aux)
Then, use the
ls command to display the creation timestamp of the directory.
$ ls -ld /proc/1218
dr-xr-xr-x 5 peter peter 0 Sep 20 16:14 /proc/1218
You can tell from the timestamp that the process 1218 began executing on Sept 20, 16:14.
If you can think of another clever way to get the start time and date, please let us know.