How can I get the start time of a long-running Linux process?

Question

Is it possible to get the start time of an old running process? It seems that ps will report the date (not the time) if it wasn't started today, and only the year if it wasn't started this year. Is the precision lost forever for old processes?

Is there anything wrong with using ps -p <pid> -o lstart? Seems like it works, but I'm not sure why it's not the immediate obvious answer for the many times this question seems to come up. — ajwood
– ajwood, Commented Apr 20, 2011 at 16:07
@ajwood It would be better to use ps -p <pid> -o lstart= to avoid additional line (header) to be printed. — Vladimir Protasov
– Vladimir Protasov, Commented Jan 15, 2014 at 15:27
Is there anything wrong with using ps -p <pid> -o lstart? Maybe the fact there's no lstart neither in 2004 Edition nor in 2013 Edition of POSIX 1003.1 standard? — Piotr Dobrogost
– Piotr Dobrogost, Commented Mar 6, 2014 at 14:21
@PiotrDobrogost, that would be a problem if the question asked about POSIX, but it's asking about Linux. — womble
– womble, Commented Dec 1, 2014 at 1:13
Mods - techraf, Makyen, David Rawson, Tsyvarev, Paul Roub - why don't you move it to a more appropriate site such as StackExchange or Superuser instead of closing the question? This is a good and useful question — Hanxue
– Hanxue, Commented Jul 19, 2019 at 2:12

rogerdpack · Accepted Answer · 2018-05-21 16:40:32Z

599

You can specify a formatter and use lstart, like this command:

ps -eo pid,lstart,cmd

The above command will output all processes, with formatters to get PID, command run, and date+time started.

Example (from Debian/Jessie command line)

$ ps -eo pid,lstart,cmd
  PID CMD                                          STARTED
    1 Tue Jun  7 01:29:38 2016 /sbin/init                  
    2 Tue Jun  7 01:29:38 2016 [kthreadd]                  
    3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]               
    5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]              
    7 Tue Jun  7 01:29:38 2016 [rcu_sched]                 
    8 Tue Jun  7 01:29:38 2016 [rcu_bh]                    
    9 Tue Jun  7 01:29:38 2016 [migration/0]               
   10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                 
   11 Tue Jun  7 01:29:38 2016 [netns]                     
  277 Tue Jun  7 01:29:38 2016 [writeback]                 
  279 Tue Jun  7 01:29:38 2016 [crypto]                    
      ...

You can read ps's manpage or check Opengroup's page for the other formatters.

edited May 21, 2018 at 16:40

rogerdpack

67.7k40 gold badges290 silver badges409 bronze badges

answered Apr 20, 2011 at 13:43

wkl

80.4k16 gold badges171 silver badges178 bronze badges

Sign up to request clarification or add additional context in comments.

12 Comments

exic Over a year ago

@bobbyrne01: change the order, e.g. pid,etime,cmd works for me on Debian Wheezy.

Pushpendre Over a year ago

ps -eo pid,etime,cmd gave "error: conflicting format options" but Adam's answer below worked on Debian GNU/Linux 7 (wheezy)

wkl Over a year ago

@Gobliins - etime is the time elapsed since the process was started.

Graeme Moss Over a year ago

for completeness, for those used to BSD syntax: ps axo pid,cmd,lstart also works

Ed Randall Over a year ago

@bobbyme01: use the -ww option

|

Community · Accepted Answer · 2017-04-13 12:36:24Z

53

The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart which always gives the full date and time the process started:

# ps -p 1 -wo pid,lstart,cmd
  PID                  STARTED CMD
    1 Mon Dec 23 00:31:43 2013 /sbin/init

# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER       PID %CPU %MEM    VSZ   RSS TT       STAT                  STARTED CMD
root         1  0.0  0.1   2800  1152 ?        Ss   Mon Dec 23 00:31:44 2013 /sbin/init
root      5151  0.3  0.1   4732  1980 pts/2    S    Sat Mar  8 16:50:47 2014 bash

For a discussion of how the information is published in the /proc filesystem, see https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running

(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:

# date; ls -ld /proc/1 /proc/$$ 
Sat Mar  8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151

Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)

edited Apr 13, 2017 at 12:36

CommunityBot

11 silver badge

answered Mar 8, 2014 at 22:16

Nathan

6315 silver badges2 bronze badges

1 Comment

Ryan Griffith Over a year ago

To see every process (not just your own) add an e (standard ps syntax) or ax (BSD syntax) argument to the ps command: i.e. ps -ewo pid,lstart,cmd or ps -axwo pid,lstart,cmd

tripleee · Accepted Answer · 2020-04-19 10:39:58Z

30

As a follow-up to Adam Matan's answer, the /proc/<pid> directory's time stamp as such is not necessarily directly useful, but you can use

awk -v RS=')' 'END{print $20}' /proc/12345/stat

to get the start time in clock ticks since system boot.¹

This is a slightly tricky unit to use; see also convert jiffies to seconds for details.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
    END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat

This should give you seconds, which you can pass to strftime() to get a (human-readable, or otherwise) timestamp.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
    END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat

Updated with some fixes from Stephane Chazelas in the comments; thanks as always!

If you only have Mawk, maybe try

awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
  NR==1 { now=$1; next }
  END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d @{}

¹ man proc; search for starttime.

edited Apr 19, 2020 at 10:39

answered Aug 3, 2016 at 9:48

tripleee

192k37 gold badges318 silver badges367 bronze badges

2 Comments

tripleee Over a year ago

Slightly refactored for production use: gist.github.com/tripleee/2a1622fdf8ab080ce3b36d95af60010a

ssokolow Over a year ago

Bear in mind that the strftime() and systime() aren't present in mawk, which is the default awk in my Debian 8 VPS images, so I can only assume that they're specific to gawk's dialect.

Peter Mortensen · Accepted Answer · 2024-12-07 23:18:38Z

21

Use:

ps -p 182454 -o lstart=

Output:

Mon Oct 18 17:26:44 2021

But can I get the answer in epoch seconds?

edited Dec 7, 2024 at 23:18

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Oct 18, 2021 at 16:16

user1070696

3472 silver badges4 bronze badges

2 Comments

ajwood Over a year ago

Not sure if ps can report that directly, but depending on your environment you can maybe use command substitution to convert it: date --date="$(ps -p 182454 -o lstart=)" '+%s'

Peter Mortensen Dec 7, 2024 at 23:20

Why is there a question in the answer? Stack Overflow is not a forum.

Adam Matan · Accepted Answer · 2011-04-20 13:45:08Z

20

ls -ltrh /proc | grep YOUR-PID-HERE

For example, my Google Chrome's PID is 11583:

ls -l /proc | grep 11583
dr-xr-xr-x  7 adam       adam                     0 2011-04-20 16:34 11583

answered Apr 20, 2011 at 13:45

Adam Matan

138k155 gold badges414 silver badges584 bronze badges

5 Comments

Evstifeev Roman Over a year ago

This does not work for me - it prints modification time (changes frequently) Maybe because of this: unix.stackexchange.com/questions/20460/…

Henning Over a year ago

The timestamp of the /proc/<pid> is not reliable.

Dan Dascalescu Over a year ago

This returned a time 9 minutes later than when a process I have information about had actually started.

Qi Fan Over a year ago

This seems to be my only option that works, though maybe not reliable. I'm on an embedded system that only has busybox ps which says invalid option for all the options mentioned by other answers.

Caesar Over a year ago

Why grep? Why not ls -ldh /proc/$pid? Or even better, date -r /proc/$pid?

Stackoverflow · Accepted Answer · 2017-09-30 22:05:45Z

9

    ps -eo pid,cmd,lstart | grep YOUR-PID-HERE

answered Sep 30, 2017 at 22:05

Stackoverflow

4771 gold badge6 silver badges14 bronze badges

1 Comment

Paul Verschoor Over a year ago

This will include it's own process too

bash-o-logist · Accepted Answer · 2011-04-20 14:07:20Z

8

 ps -eo pid,etime,cmd|sort -n -k2

answered Apr 20, 2011 at 14:07

bash-o-logist

6,9511 gold badge20 silver badges14 bronze badges

Comments

Peter Mortensen · Accepted Answer · 2024-12-07 23:17:34Z

-1

Use the command ls -ld /proc/process_id, where process_id can be found using the top command.

edited Dec 7, 2024 at 23:17

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Aug 12, 2021 at 1:17

Snehal Rajput

4564 silver badges8 bronze badges

1 Comment

tripleee Over a year ago

This just repeats information from older answers, without the caveats.

Collectives™ on Stack Overflow

How can I get the start time of a long-running Linux process?

8 Answers 8

12 Comments

1 Comment

2 Comments

2 Comments

5 Comments

1 Comment

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

8 Answers 8

12 Comments

1 Comment

2 Comments

2 Comments

5 Comments

1 Comment

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related