How to get the process start date and time
How can we determine when a running process was started?
The venerable ps command deserves first consideration.
Most Linux command-line users are familiar with either the standard UNIX notation or the BSD notation when it comes to specifying ps options.
If ps -ef is what you use, that is the UNIX notation.
The STIME column displays the start time or date. From the above, we can tell that process 4901 (emacs) began execution at 16:34 (4:34 pm). But on what day, today?
From the ps man page: 'Only the year will be displayed if the process was not started the same year ps was invoked, or "mmmdd" if it was not started the same day, or "HH:MM" otherwise.'
So, emacs was started at 16:34 TODAY.
What is the start time for the other process, the firefox process with pid 1218?
The STIME for process 1218 reads Sep20 (which was yesterday). But what time yesterday?
The default ps -ef only tells you the start date but NOT the time if a process was NOT started on the same day.
If the BSD notation is more familiar to you, you will find that ps aux yields similar results.
The Start column in the above output only reveals the start date if the process is older than the current day.
There are (at least) 2 ways to determine the exact start time if the process was started before the current day.
Solution 1
Specify elapsed time in the ps output format.
The above ps command specifies 3 fields to be included in the output: the process pid, the command, and the elapsed time, respectively.
etime is the elapsed time since the process was started, in the form dd-hh:mm:ss. dd is the number of days; hh, the number of hours; mm, the number of minutes; ss, the number of seconds.
The firefox command started execution 2 days, 16 hours, 4 minutes and 45 seconds ago. To find the exact time, you need to do some simple math.
If you prefer the BSD notation, issue this command:
Solution 2
Get the process pid and read off the timestamp in the corresponding subdirectory in /proc.
First, get the process pid using the ps command (ps -ef or ps aux)
Then, use the ls command to display the creation timestamp of the directory.
You can tell from the timestamp that the process 1218 began executing on Sept 20, 16:14.
If you can think of another clever way to get the start time and date, please let us know.
The venerable ps command deserves first consideration.
Most Linux command-line users are familiar with either the standard UNIX notation or the BSD notation when it comes to specifying ps options.
If ps -ef is what you use, that is the UNIX notation.
$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Sep20 ? 00:00:03 init [3]
peter 1218 1 0 Sep20 ? 00:21:35 /usr/lib/iceweasel/firefox-bin -a firefox
peter 4901 1 1 16:34 ? 00:01:12 /usr/bin/emacs-snapshot-gtk
The STIME column displays the start time or date. From the above, we can tell that process 4901 (emacs) began execution at 16:34 (4:34 pm). But on what day, today?
From the ps man page: 'Only the year will be displayed if the process was not started the same year ps was invoked, or "mmmdd" if it was not started the same day, or "HH:MM" otherwise.'
So, emacs was started at 16:34 TODAY.
What is the start time for the other process, the firefox process with pid 1218?
The STIME for process 1218 reads Sep20 (which was yesterday). But what time yesterday?
The default ps -ef only tells you the start date but NOT the time if a process was NOT started on the same day.
If the BSD notation is more familiar to you, you will find that ps aux yields similar results.
$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 1576 540 ? Ss Sep20 0:03 init[3]
peter 1218 0.5 8.9 201252 45456 ? Sl Sep20 21:35 /usr/lib/iceweasel/firefox-bin -a firefox
The Start column in the above output only reveals the start date if the process is older than the current day.
There are (at least) 2 ways to determine the exact start time if the process was started before the current day.
Solution 1
Specify elapsed time in the ps output format.
$ ps -eo pid,cmd,etime
PID CMD ELAPSED
1218 /usr/lib/iceweasel/firefox-bin - 2-16:04:45
The above ps command specifies 3 fields to be included in the output: the process pid, the command, and the elapsed time, respectively.
etime is the elapsed time since the process was started, in the form dd-hh:mm:ss. dd is the number of days; hh, the number of hours; mm, the number of minutes; ss, the number of seconds.
The firefox command started execution 2 days, 16 hours, 4 minutes and 45 seconds ago. To find the exact time, you need to do some simple math.
If you prefer the BSD notation, issue this command:
$ ps axo pid,cmd,etime
PID CMD ELAPSED
1218 /usr/lib/iceweasel/firefox-bin - 2-16:04:57
Solution 2
Get the process pid and read off the timestamp in the corresponding subdirectory in /proc.
First, get the process pid using the ps command (ps -ef or ps aux)
Then, use the ls command to display the creation timestamp of the directory.
$ ls -ld /proc/1218
dr-xr-xr-x 5 peter peter 0 Sep 20 16:14 /proc/1218
You can tell from the timestamp that the process 1218 began executing on Sept 20, 16:14.
If you can think of another clever way to get the start time and date, please let us know.