How to determine when process was started

There are at least several ways to determine when the process was started to help you investigate and trace potential issues. I will briefly introduce four different methods so you can choose to adapt and extend most useful one.

The first method is to print the last modification time of the process directory inside proc filesystem.

$ stat --printf="%y\n" /proc/2326
2016-10-06 08:21:42.451264052 +0000

The second method is to print time the command started using ps utility.

$ ps -p 2326 -o lstart=
Thu Oct  6 08:21:42 2016

The third method is to use seconds that elapsed since the process started to calculate time the command started.

$ date --date "now - $(ps -p 2326 -o etimes=) seconds"
Thu Oct  6 08:21:42 UTC 2016

The fourth method is to use clock ticks that elapsed between system boot and process execution to calculate time the command started.

This method is suited for systems using at least Linux kernel 2.6 as value retrieved from process status information file was expressed earlier in different way.
$ date --date "now - $(cut -d " " -f 1 /proc/uptime) seconds + $(awk '{print int($22/'$(perl -e "use POSIX;print sysconf(_SC_CLK_TCK);")')}' /proc/2326/stat) seconds"
Thu Oct  6 08:21:42 UTC 2016

Please read ps(1) and proc(5) manual pages to get better understanding of executed commands.

Milosz Galazka's Picture

About Milosz Galazka

Milosz is a system administrator working for a successful Polish company and a long time supporter of Free Software Foundation and Debian operating system.

Gdansk, Poland