Linux – When was a process started

linuxprocprocessps

To know when was a process started, my first guess was to check the time when /proc/<pid>/cmdline was written/modified the last time.

ps also shows a START field. I thought both of these sources would be the same. Sometimes they are not the same. How could that be?

Best Answer

On Linux at least, you can also do:

ps -o lstart= -p the-pid

to have a more useful start time.

Note however that it's the time the process was started, not necessarily the time the command that it is currently executing was invoked. Processes can (and generally do) run more than one command in their lifetime. And commands sometimes spawn other processes.

The mtimes of the files in /proc on Linux (at least) are generally the date when those files were instantiated, which would be the first time something tried to access them or list the directory content.

For instance:

$ sh -c 'date +%T.%N; sleep 3; echo /proc/"$$"/xx*; sleep 3; stat -c %y "/proc/$$/cmdline"'
13:39:14.791809617
/proc/31407/xx*
2013-01-22 13:39:17.790278538 +0000

Expanding /proc/$$/xx* caused the shell to read the content of /proc/$$ which caused the cmdline file to be instantiated.

See also: Timestamp of socket in /proc//fd

Related Question