Linux – Finding out with which parameters a program was started

On Linux at least, you can also do:

ps -o lstart= -p the-pid

to have a more useful start time.

Note however that it's the time the process was started, not necessarily the time the command that it is currently executing was invoked. Processes can (and generally do) run more than one command in their lifetime. And commands sometimes spawn other processes.

The mtimes of the files in /proc on Linux (at least) are generally the date when those files were instantiated, which would be the first time something tried to access them or list the directory content.

For instance:

$ sh -c 'date +%T.%N; sleep 3; echo /proc/"$$"/xx*; sleep 3; stat -c %y "/proc/$$/cmdline"'
13:39:14.791809617
/proc/31407/xx*
2013-01-22 13:39:17.790278538 +0000

Expanding /proc/$$/xx* caused the shell to read the content of /proc/$$ which caused the cmdline file to be instantiated.

See also: Timestamp of socket in /proc//fd

An easy way to follow the PPID chain backwards is with the pstree tool:

pstree -p PID

This will show all the parent processes of the specified PID, for example:

$ pstree 42284
-+= 00001 root /sbin/launchd
 \-+= 00199 jack /sbin/launchd
   \-+= 00254 jack /Applications/iTerm.app/Contents/MacOS/iTerm -psn_0_90134
     \-+= 00309 root login -fp jack
       \-+= 00310 jack -bash
         \--= 42284 jack vim site.txt