To know when was a process started, my first guess was to check the time when /proc/<pid>/cmdline
was written/modified the last time.
ps
also shows a START
field. I thought both of these sources would be the same. Sometimes they are not the same. How could that be?
Best Answer
On Linux at least, you can also do:
to have a more useful start time.
Note however that it's the time the process was started, not necessarily the time the command that it is currently executing was invoked. Processes can (and generally do) run more than one command in their lifetime. And commands sometimes spawn other processes.
The mtimes of the files in
/proc
on Linux (at least) are generally the date when those files were instantiated, which would be the first time something tried to access them or list the directory content.For instance:
Expanding
/proc/$$/xx*
caused the shell to read the content of/proc/$$
which caused thecmdline
file to be instantiated.See also: Timestamp of socket in /proc//fd