361

Is it possible to get the start time of an old running process? It seems that ps will report the date (not the time) if it wasn't started today, and only the year if it wasn't started this year. Is the precision lost forever for old processes?

ajwood
  • 18,227
  • 15
  • 61
  • 104
  • 28
    Is there anything wrong with using `ps -p -o lstart`? Seems like it works, but I'm not sure why it's not the immediate obvious answer for the many times this question seems to come up. – ajwood Apr 20 '11 at 16:07
  • 1
    Here is a detailed page on the subject: http://linuxcommando.blogspot.com/2008/09/how-to-get-process-start-date-and-time.html – Delphy Apr 20 '11 at 13:43
  • 14
    @ajwood It would be better to use `ps -p -o lstart=` to avoid additional line (header) to be printed. – Vladimir Protasov Jan 15 '14 at 15:27
  • 3
    *Is there anything wrong with using `ps -p -o lstart`?* Maybe the fact there's no `lstart` neither in [2004 Edition](http://pubs.opengroup.org/onlinepubs/000095399/utilities/ps.html) nor in [2013 Edition](http://pubs.opengroup.org/onlinepubs/9699919799/utilities/ps.html) of POSIX 1003.1 standard? – Piotr Dobrogost Mar 06 '14 at 14:21
  • 6
    @PiotrDobrogost, that would be a problem if the question asked about POSIX, but it's asking about Linux. – womble Dec 01 '14 at 01:13
  • 1
    Note that `lstart` (and, I assume, `ps`'s other start-time fields) are susceptible to clock changes. If an NTP update occurs and changes your clock the output of `lstart` will differ before and after. I didn't anticipate that. – dimo414 Apr 07 '16 at 00:09
  • [This answer](http://unix.stackexchange.com/a/274722/19157) offers a clever boot-relative start time which doesn't have the same issue. – dimo414 Apr 07 '16 at 05:11
  • @dimo414 Thanks! That's essentially the same thing as the accepted answer here though, no? – ajwood Apr 07 '16 at 13:55
  • @ajwood no, the boot-relative start time of a process is going to be constant, whereas the elapsed time is always increasing. – dimo414 Apr 07 '16 at 14:05
  • This question is off-topic here, and was [asked on Serverfault in 2009 already](https://serverfault.com/questions/95643/linux-how-do-i-see-when-a-process-started). – Dan Dascalescu Jun 05 '17 at 01:13
  • 7
    Mods - techraf, Makyen, David Rawson, Tsyvarev, Paul Roub - why don't you move it to a more appropriate site such as StackExchange or Superuser instead of closing the question? This is a good and useful question – Hanxue Jul 19 '19 at 02:12
  • 1
    I second @Hanxue's suggestion, especially because the referred Serverfault question has not really as complete answers as this one has. Also please consider how often this has been upvoted and starred _here_ on Stackoverflow compared to the very few upvotes and stars on Serverfault. – Axel Beckert Jan 10 '20 at 12:58

8 Answers8

555

You can specify a formatter and use lstart, like this command:

ps -eo pid,lstart,cmd

The above command will output all processes, with formatters to get PID, command run, and date+time started.

Example (from Debian/Jessie command line)

$ ps -eo pid,lstart,cmd
  PID CMD                                          STARTED
    1 Tue Jun  7 01:29:38 2016 /sbin/init                  
    2 Tue Jun  7 01:29:38 2016 [kthreadd]                  
    3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]               
    5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]              
    7 Tue Jun  7 01:29:38 2016 [rcu_sched]                 
    8 Tue Jun  7 01:29:38 2016 [rcu_bh]                    
    9 Tue Jun  7 01:29:38 2016 [migration/0]               
   10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                 
   11 Tue Jun  7 01:29:38 2016 [netns]                     
  277 Tue Jun  7 01:29:38 2016 [writeback]                 
  279 Tue Jun  7 01:29:38 2016 [crypto]                    
      ...

You can read ps's manpage or check Opengroup's page for the other formatters.

rogerdpack
  • 62,887
  • 36
  • 269
  • 388
wkl
  • 77,184
  • 16
  • 165
  • 176
  • When commands containing long strings some of the text is cut off e.g ` 3538 sendmail: Queue runner@01:0 4-05:19:43` How could you have the entire string printed? i.e not cut short – bobbyrne01 Jul 23 '13 at 21:36
  • For those who want to use it on android, use ps from busybox instead, and the command column name is comm, that is `busybox ps -eo pid,comm,etime` – accuya Dec 05 '13 at 05:51
  • 3
    @bobbyrne01: change the order, e.g. pid,etime,cmd works for me on Debian Wheezy. – exic Jan 14 '14 at 08:50
  • ps -eo pid,etime,cmd gave "error: conflicting format options" but [Adam's answer](http://stackoverflow.com/a/5731365/538192) below worked on Debian GNU/Linux 7 (wheezy) – Pushpendre Mar 24 '14 at 19:14
  • hello, is "etime" the time the process is running or is it the time the process used cpu time? – Gobliins Jun 06 '16 at 06:59
  • 4
    @Gobliins - `etime` is the time elapsed since the process was started. – wkl Jun 06 '16 at 13:42
  • 5
    for completeness, for those used to BSD syntax: `ps axo pid,cmd,lstart` also works – Graeme Moss Oct 12 '16 at 07:50
  • 2
    @bobbyme01: use the -ww option – Ed Randall Jan 17 '17 at 15:02
  • 1
    Be aware that `lstart` time can change, the `stat` methods below are safer - https://unix.stackexchange.com/questions/274610/output-of-ps-lstart-changed. – slm Jun 20 '19 at 15:13
  • When I use `ps -u USERNAME` I can get the processes run by a specific user. However, when I try to combine this with the above command (`ps -u USERNAME -eo pid,lstart,cmd`, or switching the order), it doesn't filter by username. How would you combine this command with the username filter? – Marses Sep 20 '22 at 08:03
  • ps: bad -o argument 'lstart', supported arguments: user,group,comm,args,pid,ppid,pgid,etime,nice,rgroup,ruser,time,tty,vsz,sid,stat,rss – Anton Duzenko Oct 13 '22 at 14:55
49

The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart which always gives the full date and time the process started:

# ps -p 1 -wo pid,lstart,cmd
  PID                  STARTED CMD
    1 Mon Dec 23 00:31:43 2013 /sbin/init

# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd
USER       PID %CPU %MEM    VSZ   RSS TT       STAT                  STARTED CMD
root         1  0.0  0.1   2800  1152 ?        Ss   Mon Dec 23 00:31:44 2013 /sbin/init
root      5151  0.3  0.1   4732  1980 pts/2    S    Sat Mar  8 16:50:47 2014 bash

For a discussion of how the information is published in the /proc filesystem, see https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running

(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:

# date; ls -ld /proc/1 /proc/$$ 
Sat Mar  8 17:14:21 EST 2014
dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1
dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151

Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)

Community
  • 1
  • 1
Nathan
  • 591
  • 4
  • 2
  • To see every process (not just your own) add an `e` (standard `ps` syntax) or `ax` (BSD syntax) argument to the ps command: i.e. `ps -ewo pid,lstart,cmd` or `ps -axwo pid,lstart,cmd` – Ryan Griffith Feb 03 '16 at 13:50
28

As a follow-up to Adam Matan's answer, the /proc/<pid> directory's time stamp as such is not necessarily directly useful, but you can use

awk -v RS=')' 'END{print $20}' /proc/12345/stat

to get the start time in clock ticks since system boot.1

This is a slightly tricky unit to use; see also convert jiffies to seconds for details.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
    END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat

This should give you seconds, which you can pass to strftime() to get a (human-readable, or otherwise) timestamp.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }
    END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat

Updated with some fixes from Stephane Chazelas in the comments; thanks as always!

If you only have Mawk, maybe try

awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '
  NR==1 { now=$1; next }
  END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |
xargs -i date -d @{}

1 man proc; search for starttime.

tripleee
  • 175,061
  • 34
  • 275
  • 318
  • Slightly refactored for production use: https://gist.github.com/tripleee/2a1622fdf8ab080ce3b36d95af60010a – tripleee Aug 17 '16 at 06:23
  • 1
    Bear in mind that the `strftime()` and `systime()` aren't present in `mawk`, which is the default `awk` in my Debian 8 VPS images, so I can only assume that they're specific to `gawk`'s dialect. – ssokolow Feb 24 '17 at 09:11
19
ls -ltrh /proc | grep YOUR-PID-HERE

For example, my Google Chrome's PID is 11583:

ls -l /proc | grep 11583
dr-xr-xr-x  7 adam       adam                     0 2011-04-20 16:34 11583
Adam Matan
  • 128,757
  • 147
  • 397
  • 562
  • 6
    This does not work for me - it prints modification time (changes frequently) Maybe because of this: http://unix.stackexchange.com/questions/20460/how-do-i-do-a-ls-and-then-sort-the-results-by-date-created – user920391 Oct 28 '14 at 22:11
  • The timestamp of the /proc/ is not reliable. – Henning Apr 26 '17 at 07:19
  • 1
    This returned a time 9 minutes later than when a process I have information about had actually started. – Dan Dascalescu Jun 05 '17 at 01:14
  • 2
    This seems to be my only option that works, though maybe not reliable. I'm on an embedded system that only has busybox `ps` which says `invalid option` for all the options mentioned by other answers. – Qi Fan Sep 07 '17 at 21:11
  • 11
    Why `grep`? Why not `ls -ldh /proc/$pid`? Or even better, `date -r /proc/$pid`? – Caesar Oct 25 '18 at 00:56
17
$ ps -p 182454 -o lstart=
Mon Oct 18 17:26:44 2021

But can I get the answer in epoch seconds?

user1070696
  • 301
  • 2
  • 4
  • Not sure if ps can report that directly, but depending on your environment you can maybe use command substitution to convert it: `date --date="$(ps -p 182454 -o lstart=)" '+%s'` – ajwood Oct 18 '21 at 16:34
9
    ps -eo pid,cmd,lstart | grep YOUR-PID-HERE
Stackoverflow
  • 449
  • 5
  • 13
7
 ps -eo pid,etime,cmd|sort -n -k2
bash-o-logist
  • 6,665
  • 1
  • 17
  • 14
0

use the command ls -ld /proc/process_id where process_id can be find using top command

Snehal Rajput
  • 335
  • 3
  • 6