LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices



Reply
 
Search this Thread
Old 01-06-2010, 02:21 PM   #1
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Rep: Reputation: 64
Question how to known when a process was started ?


Hi !

I need to known when a process was started.
It is a broken/buggy program and the time it was started can help me to fix it. This program it is not started by command line, not an interactive program. It is started by a complex chain of events, so I can't trace it back based only on the events.

Code:
[root@minibit ~]# ps aux | grep fb_rebuild
root      5249  0.0  0.0   8700  1076 ?        Ss    2009   9:35 /bin/bash /usr/local/sbin/fb_rebuild.sh
root     27603  0.0  0.0   8700  1076 ?        Ss    2009   3:43 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit ~]# ps -ef | grep fb_rebuild
root      5249  5248  0  2009 ?        00:09:35 /bin/bash /usr/local/sbin/fb_rebuild.sh
root     27603 27602  0  2009 ?        00:03:43 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit ~]#
It was started somewhere in the last year, so the ps command doesn't display more details other than "2009".

I looked at /proc/<proc-id> but the time of creation of pseudo files has nothing to do with the started time. Neither any files under /proc/<proc-id> has any useful information about when it was started.

The machine is up and running for more than 400 days now, so the PID counter was reclycled more than one time, than I can't say that 27603 was stared after 5249...

any ideas ?

Last edited by marozsas; 01-06-2010 at 02:22 PM.
 
Old 01-06-2010, 02:26 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
In my experience the dates of /proc/12345 always match up with the exact age of the process, unless there is something odd that /proc is doing after such a long time.
 
1 members found this post helpful.
Old 01-07-2010, 05:12 AM   #3
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 64
hi acid_kewpie !

I am using CentOS 5.3 on this machine, kernel 2.6.18-164.el5.

ls displaying creation time...

Code:
[root@minibit ~]# ls  -l --time=ctime /proc/27603
total 0
dr-xr-xr-x 2 root root 0 Jan  7 04:02 attr
-r-------- 1 root root 0 Jan  7 04:02 auxv
-r--r--r-- 1 root root 0 Jan  7 04:46 cmdline
-rw-r--r-- 1 root root 0 Jan  7 04:02 coredump_filter
-r--r--r-- 1 root root 0 Jan  7 04:02 cpuset
...
 
Old 01-07-2010, 05:13 AM   #4
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 64
hi acid_kewpie !

I am using CentOS 5.3 on this machine, kernel 2.6.18-164.el5.

ls displaying creation time...

Code:
[root@minibit ~]# ls  -l --time=ctime /proc/27603
total 0
dr-xr-xr-x 2 root root 0 Jan  7 04:02 attr
-r-------- 1 root root 0 Jan  7 04:02 auxv
-r--r--r-- 1 root root 0 Jan  7 04:46 cmdline
-rw-r--r-- 1 root root 0 Jan  7 04:02 coredump_filter
-r--r--r-- 1 root root 0 Jan  7 04:02 cpuset
...
 
Old 01-07-2010, 05:33 AM   #5
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 64
ooops 1, sorry the duplicate previous post
ooops 2, the correct kernel version is 2.6.18-128.
ooops 3, the date of creation of /proc/<proc-id> (the base dir, not its descendants) returns indeed the time of creation of process ("ls -ld --time=ctime /proc/27603"):
Code:
[root@minibit ~]# ls -ld --time=ctime /proc/5249 /proc/27603 
dr-xr-xr-x 5 root root 0 Aug  7 04:15 /proc/27603
dr-xr-xr-x 5 root root 0 Nov 16 14:21 /proc/5249
[root@minibit ~]#
thanks acid_kewpie !

Last edited by marozsas; 01-07-2010 at 05:34 AM.
 
Old 01-07-2010, 05:39 AM   #6
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,509

Rep: Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957
Hi marozsas. The ctime is not the creation time. Take in mind that unix filesystems are not able to store this information (if I'm not wrong, ext4 added support for creation time, but most of the *nix utility are still not able to gather this information). Instead ctime is the change time, that is the time at which changes have been made on the inode of the file (and it is updated every time a file changes).

Your best bet to retrieve the start time of the process is probably:
Code:
ps -C fb_rebuild.sh -o pid,etime,args
where etime is the elapsed time in [[dd-]hh:]mm:ss format. See man ps for details.
 
1 members found this post helpful.
Old 01-07-2010, 06:52 AM   #7
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 64
oh yes, you're right colucix ! It was a silly mistake, may bad....
and thanks for the alternative way to get the time of the process using "ps". I will explore those formating options.

cheers,
 
Old 01-07-2010, 07:14 AM   #8
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 64
uhmmm, looks like the time of /proc/<proc-id> it is not accurate since there is no creation time as colucix has pointed in his last post.
exploring other ps output formating options, I found bsdstart, and both (etime/bsdstart) return consistent data (thanks god!)

Code:
[root@minibit root]# ls -ld /proc/5249
dr-xr-xr-x 5 root root 0 Nov 16 14:21 /proc/5249
[root@minibit root]# ps -p 5249 -o pid,etime,args
  PID     ELAPSED COMMAND
 5249 66-05:44:13 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit root]# ps -p 5249 -o pid,bsdstart,args
  PID  START COMMAND
 5249 Nov  2 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit root]#
I mean, using etime I got 66 days ago from now (Jan 7), which is Nov 2, which is the same date returned from bsdstart option.
Please, note it is not the same date of the changed time of /proc/5249 (Nov 16).

Besides that, the date of Nov 2 is more likely because this process is supposed to run sometime in the first week of the month. So I will stick with Nov 2.

Thanks guys, it was nice.
 
Old 01-07-2010, 08:17 AM   #9
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,509

Rep: Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957Reputation: 1957
I was not aware of the bsdstart field. Thank you for the feedback!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How can you view the progress of a process started in a non-interactive shell? timingalls Linux - General 1 04-21-2009 03:29 PM
[SOLVED] what/who started that process unkie888 Linux - General 2 11-05-2007 09:05 AM
to know how many users are there and killing some of process started remotely manoj111 Fedora 1 04-03-2007 03:16 PM
monitor processes to be notified when a new process is started? cfh Programming 2 10-03-2005 08:07 PM
If I want, that process has automatically started at system loading or reloading ukrainet Linux - Newbie 2 12-14-2004 10:39 AM


All times are GMT -5. The time now is 10:07 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration