How to get the start time of a long-running Linux process? - linux

Question

Is it possible to get the start time of an old running process? It seems that ps will report the date (not the time) if it wasn't started today, and only the year if it wasn't started this year. Is the precision lost forever for old processes?

Answer 1

You can specify a formatter and use lstart, like this command:
ps -eo pid,lstart,cmd
The above command will output all processes, with formatters to get PID, command run, and date+time started.
Example (from Debian/Jessie command line)
$ ps -eo pid,lstart,cmd
PID CMD STARTED
1 Tue Jun 7 01:29:38 2016 /sbin/init
2 Tue Jun 7 01:29:38 2016 [kthreadd]
3 Tue Jun 7 01:29:38 2016 [ksoftirqd/0]
5 Tue Jun 7 01:29:38 2016 [kworker/0:0H]
7 Tue Jun 7 01:29:38 2016 [rcu_sched]
8 Tue Jun 7 01:29:38 2016 [rcu_bh]
9 Tue Jun 7 01:29:38 2016 [migration/0]
10 Tue Jun 7 01:29:38 2016 [kdevtmpfs]
11 Tue Jun 7 01:29:38 2016 [netns]
277 Tue Jun 7 01:29:38 2016 [writeback]
279 Tue Jun 7 01:29:38 2016 [crypto]
...
You can read ps's manpage or check Opengroup's page for the other formatters.

Answer 2

The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart which always gives the full date and time the process started:
# ps -p 1 -wo pid,lstart,cmd
PID STARTED CMD
1 Mon Dec 23 00:31:43 2013 /sbin/init
# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER PID %CPU %MEM VSZ RSS TT STAT STARTED CMD
root 1 0.0 0.1 2800 1152 ? Ss Mon Dec 23 00:31:44 2013 /sbin/init
root 5151 0.3 0.1 4732 1980 pts/2 S Sat Mar 8 16:50:47 2014 bash
For a discussion of how the information is published in the /proc filesystem, see
https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running
(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:
# date; ls -ld /proc/1 /proc/$$
Sat Mar 8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151
Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)

Answer 3

As a follow-up to Adam Matan's answer, the /proc/<pid> directory's time stamp as such is not necessarily directly useful, but you can use
awk -v RS=')' 'END{print $20}' /proc/12345/stat
to get the start time in clock ticks since system boot.1
This is a slightly tricky unit to use; see also convert jiffies to seconds for details.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat
This should give you seconds, which you can pass to strftime() to get a (human-readable, or otherwise) timestamp.
awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat
Updated with some fixes from Stephane Chazelas in the comments; thanks as always!
If you only have Mawk, maybe try
awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
NR==1 { now=$1; next }
END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d #{}
1 man proc; search for starttime.

Answer 4

ls -ltrh /proc | grep YOUR-PID-HERE
For example, my Google Chrome's PID is 11583:
ls -l /proc | grep 11583
dr-xr-xr-x 7 adam adam 0 2011-04-20 16:34 11583

Answer 5

$ ps -p 182454 -o lstart=
Mon Oct 18 17:26:44 2021
But can I get the answer in epoch seconds?

Answer 6

ps -eo pid,cmd,lstart | grep YOUR-PID-HERE

Answer 7

ps -eo pid,etime,cmd|sort -n -k2

Answer 8

use the command ls -ld /proc/process_id where process_id can be find using top command