Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
I need to known when a process was started.
It is a broken/buggy program and the time it was started can help me to fix it. This program it is not started by command line, not an interactive program. It is started by a complex chain of events, so I can't trace it back based only on the events.
It was started somewhere in the last year, so the ps command doesn't display more details other than "2009".
I looked at /proc/<proc-id> but the time of creation of pseudo files has nothing to do with the started time. Neither any files under /proc/<proc-id> has any useful information about when it was started.
The machine is up and running for more than 400 days now, so the PID counter was reclycled more than one time, than I can't say that 27603 was stared after 5249...
ooops 1, sorry the duplicate previous post
ooops 2, the correct kernel version is 2.6.18-128.
ooops 3, the date of creation of /proc/<proc-id> (the base dir, not its descendants) returns indeed the time of creation of process ("ls -ld --time=ctime /proc/27603"):
[root@minibit ~]# ls -ld --time=ctime /proc/5249 /proc/27603
dr-xr-xr-x 5 root root 0 Aug 7 04:15 /proc/27603
dr-xr-xr-x 5 root root 0 Nov 16 14:21 /proc/5249
Hi marozsas. The ctime is not the creation time. Take in mind that unix filesystems are not able to store this information (if I'm not wrong, ext4 added support for creation time, but most of the *nix utility are still not able to gather this information). Instead ctime is the change time, that is the time at which changes have been made on the inode of the file (and it is updated every time a file changes).
Your best bet to retrieve the start time of the process is probably:
ps -C fb_rebuild.sh -o pid,etime,args
where etime is the elapsed time in [[dd-]hh:]mm:ss format. See man ps for details.
uhmmm, looks like the time of /proc/<proc-id> it is not accurate since there is no creation time as colucix has pointed in his last post.
exploring other ps output formating options, I found bsdstart, and both (etime/bsdstart) return consistent data (thanks god!)
I mean, using etime I got 66 days ago from now (Jan 7), which is Nov 2, which is the same date returned from bsdstart option.
Please, note it is not the same date of the changed time of /proc/5249 (Nov 16).
Besides that, the date of Nov 2 is more likely because this process is supposed to run sometime in the first week of the month. So I will stick with Nov 2.