39

How can I see when a process started, assuming I know the pid. (On Linux)

6 Answers 6

49

If you want only the start time, you can select the field and suppress the header by doing this:

 ps -p YOURPID -o lstart=

the output will look like this:

 Mon Dec 14 17:17:16 2009

which is ctime(3) format and you can parse it to split out the relevant parts.

Other start fields such as start, stime, bsdstart and start_time age the time (after 24 hours only the date is shown, for example).

You can, however, use them directly for recently started processes without further parsing:

ps -p YOURPID -o stime=

which would output something like:

09:26
1
  • This works on a mac too!
    – Brad Parks
    Sep 15, 2015 at 17:04
9

awk '{print $22}' /proc/$pid/stat - gives you the start time in jiffies after boot

5
  • Beautifully obscure answer!
    – wzzrd
    Dec 18, 2009 at 10:23
  • Riddle me this. A system with an uptime of '17:57' has a process with a start time of '727975'. Looks like the process started 8 days from now?
    – Scott Pack
    Dec 18, 2009 at 13:25
  • 1
    It's actually in jiffies (100/sec)
    – MarkR
    Dec 18, 2009 at 14:32
  • 1
    Way too obscure! And besides, now you have to look up the boot time and do the math to convert jiffies to seconds and calculate the offset to get clock time. Easy, but too many steps. See Chopper3's answer. Dec 18, 2009 at 15:08
  • 1
    The amount of jiffies per second is stored in system variable HZ. It is mostly 100. To calculate it in shell you might use this: stackoverflow.com/a/44524937/1950345
    – reichhart
    Jun 24, 2017 at 9:39
7

"ps -f" - it's in the man pages

2
  • 2
    And to select the known pid: ps -f -p yourpid Dec 18, 2009 at 15:05
  • 2
    Actually this works if the process was started the same day, but if it was started another day you only get the day, but not the time of day as on @DennisWilliamson answer Mar 24, 2017 at 9:00
0

If there's a single process with a given name (e.g. openvpn) on the host, you can do:

ps -p `pgrep openvpn` -o lstart=
0

Following Dennis Williamson's excellent answer, the ps command also has the -O option which, according to the man page: is "Like -o, but preloaded with some default columns." This allows you to grep for the command (program) associated with the PID, if you don't know the PID itself.

Example: finding when an apt-get process hanging on Debian/Ubuntu started:

ps -A -O lstart= | grep apt-get | grep -v grep

Piping to grep -v grep filters out lines containing the string "grep", which removes the command we just typed in (since we don't want it).

On my system right now, this gives:

1461407  Apr 15 06:00:00 2021 S ?        00:05:09 apt-get autoremove -y
-2

one way you can ps -f |grep <pid> as you said you the pid otherwise you can see in top also

1
  • 1
    This will match far more things than planned. ps has the --pid option to pass directly a specific pid you are interested in. Jan 11, 2020 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.