netstat

sanjaykhuntia · 11-01-2007, 10:22 AM

hi,
can anyone plz tell me how to get the information what "netstat -nap" command gives? i want the pid, protocol, port number etc from this output. also i dont want to taking the help of parsing. is there any open code or api s available that does the same task as i want. please refer me any site which offers me that information.

my second question- how and from where can i get the process creation time of a process? i know that there are 3 times specifically atime,ctime,mtime maintained in stat structure for a file. but i need the create time of a process...

i hope i will get some good reply.

BTW thanks in advance.

sanjay

vadiml · 11-01-2007, 12:02 PM

Sanjay,

you can always read the netstat sources....
and for process creation time: look at the creation time of the /proc/$(PID) directory

sanjaykhuntia · 11-02-2007, 12:00 AM

thanks for the suggestion,but one thing i doubt i have searched /proc directory thoroughly stll unable to get the process creation time. if you see the /proc/pid/stat, there you can fine 4 time stamps related to process but nothing is mentioned regarding the creation time. also you have to parse the stat file accordingly to get those times,, but not certain abt creation time. can you please give me a broad idea..

regards,
sanjay

chrism01 · 11-02-2007, 01:59 AM

Well,
ps -ef
gives the process start time as 5th field

vadiml · 11-02-2007, 05:38 AM

Quote:

Originally Posted by sanjaykhuntia

thanks for the suggestion,but one thing i doubt i have searched /proc directory thoroughly stll unable to get the process creation time. if you see the /proc/pid/stat, there you can fine 4 time stamps related to process but nothing is mentioned regarding the creation time. also you have to parse the stat file accordingly to get those times,, but not certain abt creation time. can you please give me a broad idea..

regards,
sanjay

I meant for a process id 5678 look at the creation time
of /proc/5678

PAix · 11-02-2007, 03:17 PM

Vadiml,
If you don't originally explain your requirement clearly, how can anyone work out you expect to see in the results?
From what I understand, you require to specify a process id (pid) in the call to the code?

Code:

ps -ef | awk -v pid="$1" '
$2==pid { if (substr($5, 3, 1) ==":")
              print "Pid " $2 " started at ", $5
          else
              print "Pid " $2 " was not started today"
        } '

If this is so and you decide to call the code "a1sh", then the call is

Code:

./a1sh 5676

and the output is one of these three:

Quote:

Pid 5678 was not started today

Pid 5678 started at 18:06

The first is when the process is found but started prior to the current date. No time, but the start date is given. The second is when the given pid isn't found and the third is when the pid is found and was started on the current date.

I hope that this meets your need? If not why not? Please explain carefully.

PAix

ghostdog74 · 11-02-2007, 09:52 PM

if you have lsof, an example only, prints out the start time at the end of each line.

Code:

ps -eo pid,start_time > processfile.txt
lsof -i -n > lsof.txt
awk 'FNR==NR{ a[$1]=$2;next}
    {
      print $0, $NF" "a[$2]  
    }        
' "processfile.txt" "lsof.txt"