How to get the start time of a long-running Linux process?

Question

Is it possible to get the start time of an old running process? It seems that ps will report the date (not the time) if it wasn't started today, and only the year if it wasn't started this year. Is the precision lost forever for old processes?

Answer 1

You can specify a formatter and use lstart, like this command:

ps -eo pid,lstart,cmd 

The above command will output all processes, with formatters to get PID, command run, and date+time started.

Example (from Debian/Jessie command line)

$ ps -eo pid,lstart,cmd   PID CMD                                          STARTED     1 Tue Jun  7 01:29:38 2016 /sbin/init                       2 Tue Jun  7 01:29:38 2016 [kthreadd]                       3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]                    5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]                   7 Tue Jun  7 01:29:38 2016 [rcu_sched]                      8 Tue Jun  7 01:29:38 2016 [rcu_bh]                         9 Tue Jun  7 01:29:38 2016 [migration/0]                   10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                     11 Tue Jun  7 01:29:38 2016 [netns]                        277 Tue Jun  7 01:29:38 2016 [writeback]                    279 Tue Jun  7 01:29:38 2016 [crypto]                           ... 

You can read ps's manpage or check Opengroup's page for the other formatters.

Answer 2

The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart which always gives the full date and time the process started:

# ps -p 1 -wo pid,lstart,cmd   PID                  STARTED CMD     1 Mon Dec 23 00:31:43 2013 /sbin/init  # ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmd USER       PID %CPU %MEM    VSZ   RSS TT       STAT                  STARTED CMD root         1  0.0  0.1   2800  1152 ?        Ss   Mon Dec 23 00:31:44 2013 /sbin/init root      5151  0.3  0.1   4732  1980 pts/2    S    Sat Mar  8 16:50:47 2014 bash 

For a discussion of how the information is published in the /proc filesystem, see https://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running

(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:

# date; ls -ld /proc/1 /proc/$$  Sat Mar  8 17:14:21 EST 2014 dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1 dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151 

Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)