how to known when a process was started ?

marozsas · 01-06-2010, 01:21 PM

Hi !

I need to known when a process was started.
It is a broken/buggy program and the time it was started can help me to fix it. This program it is not started by command line, not an interactive program. It is started by a complex chain of events, so I can't trace it back based only on the events.

Code:

[root@minibit ~]# ps aux | grep fb_rebuild
root      5249  0.0  0.0   8700  1076 ?        Ss    2009   9:35 /bin/bash /usr/local/sbin/fb_rebuild.sh
root     27603  0.0  0.0   8700  1076 ?        Ss    2009   3:43 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit ~]# ps -ef | grep fb_rebuild
root      5249  5248  0  2009 ?        00:09:35 /bin/bash /usr/local/sbin/fb_rebuild.sh
root     27603 27602  0  2009 ?        00:03:43 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit ~]#

It was started somewhere in the last year, so the ps command doesn't display more details other than "2009".

I looked at /proc/<proc-id> but the time of creation of pseudo files has nothing to do with the started time. Neither any files under /proc/<proc-id> has any useful information about when it was started.

The machine is up and running for more than 400 days now, so the PID counter was reclycled more than one time, than I can't say that 27603 was stared after 5249...

any ideas ?

acid_kewpie · 01-06-2010, 01:26 PM

In my experience the dates of /proc/12345 always match up with the exact age of the process, unless there is something odd that /proc is doing after such a long time.

marozsas · 01-07-2010, 04:12 AM

hi acid_kewpie !

I am using CentOS 5.3 on this machine, kernel 2.6.18-164.el5.

ls displaying creation time...

Code:

[root@minibit ~]# ls  -l --time=ctime /proc/27603
total 0
dr-xr-xr-x 2 root root 0 Jan  7 04:02 attr
-r-------- 1 root root 0 Jan  7 04:02 auxv
-r--r--r-- 1 root root 0 Jan  7 04:46 cmdline
-rw-r--r-- 1 root root 0 Jan  7 04:02 coredump_filter
-r--r--r-- 1 root root 0 Jan  7 04:02 cpuset
...

marozsas · 01-07-2010, 04:13 AM

hi acid_kewpie !

I am using CentOS 5.3 on this machine, kernel 2.6.18-164.el5.

ls displaying creation time...

Code:

[root@minibit ~]# ls  -l --time=ctime /proc/27603
total 0
dr-xr-xr-x 2 root root 0 Jan  7 04:02 attr
-r-------- 1 root root 0 Jan  7 04:02 auxv
-r--r--r-- 1 root root 0 Jan  7 04:46 cmdline
-rw-r--r-- 1 root root 0 Jan  7 04:02 coredump_filter
-r--r--r-- 1 root root 0 Jan  7 04:02 cpuset
...

marozsas · 01-07-2010, 04:33 AM

ooops 1, sorry the duplicate previous post
ooops 2, the correct kernel version is 2.6.18-128.
ooops 3, the date of creation of /proc/<proc-id> (the base dir, not its descendants) returns indeed the time of creation of process ("ls -ld --time=ctime /proc/27603"):

Code:

[root@minibit ~]# ls -ld --time=ctime /proc/5249 /proc/27603 
dr-xr-xr-x 5 root root 0 Aug  7 04:15 /proc/27603
dr-xr-xr-x 5 root root 0 Nov 16 14:21 /proc/5249
[root@minibit ~]#

thanks acid_kewpie !

colucix · 01-07-2010, 04:39 AM

Hi marozsas. The ctime is not the creation time. Take in mind that unix filesystems are not able to store this information (if I'm not wrong, ext4 added support for creation time, but most of the *nix utility are still not able to gather this information). Instead ctime is the change time, that is the time at which changes have been made on the inode of the file (and it is updated every time a file changes).

Your best bet to retrieve the start time of the process is probably:

Code:

ps -C fb_rebuild.sh -o pid,etime,args

where etime is the elapsed time in [[dd-]hh:]mm:ss format. See man ps for details.

marozsas · 01-07-2010, 05:52 AM

oh yes, you're right colucix ! It was a silly mistake, may bad....
and thanks for the alternative way to get the time of the process using "ps". I will explore those formating options.

cheers,

marozsas · 01-07-2010, 06:14 AM

uhmmm, looks like the time of /proc/<proc-id> it is not accurate since there is no creation time as colucix has pointed in his last post.
exploring other ps output formating options, I found bsdstart, and both (etime/bsdstart) return consistent data (thanks god!)

Code:

[root@minibit root]# ls -ld /proc/5249
dr-xr-xr-x 5 root root 0 Nov 16 14:21 /proc/5249
[root@minibit root]# ps -p 5249 -o pid,etime,args
  PID     ELAPSED COMMAND
 5249 66-05:44:13 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit root]# ps -p 5249 -o pid,bsdstart,args
  PID  START COMMAND
 5249 Nov  2 /bin/bash /usr/local/sbin/fb_rebuild.sh
[root@minibit root]#

I mean, using etime I got 66 days ago from now (Jan 7), which is Nov 2, which is the same date returned from bsdstart option.
Please, note it is not the same date of the changed time of /proc/5249 (Nov 16).

Besides that, the date of Nov 2 is more likely because this process is supposed to run sometime in the first week of the month. So I will stick with Nov 2.

Thanks guys, it was nice.

colucix · 01-07-2010, 07:17 AM

I was not aware of the bsdstart field. Thank you for the feedback!