Linux - How do I see when a process started?

Question

How can I see when a process started, assuming I know the pid. (On Linux)

Answer 1

If you want only the start time, you can select the field and suppress the header by doing this:

 ps -p YOURPID -o lstart=

the output will look like this:

 Mon Dec 14 17:17:16 2009

which is ctime(3) format and you can parse it to split out the relevant parts.

Other start fields such as start, stime, bsdstart and start_time age the time (after 24 hours only the date is shown, for example).

You can, however, use them directly for recently started processes without further parsing:

ps -p YOURPID -o stime=

which would output something like:

09:26

Answer 2

"ps -f" - it's in the man pages

Answer 3

awk '{print $22}' /proc/$pid/stat - gives you the start time in jiffies after boot

Answer 4

Following Dennis Williamson's excellent answer, the ps command also has the -O option which, according to the man page: is "Like -o, but preloaded with some default columns." This allows you to grep for the command (program) associated with the PID, if you don't know the PID itself.

Example: finding when an apt-get process hanging on Debian/Ubuntu started:

ps -A -O lstart= | grep apt-get | grep -v grep

Piping to grep -v grep filters out lines containing the string "grep", which removes the command we just typed in (since we don't want it).

On my system right now, this gives:

1461407  Apr 15 06:00:00 2021 S ?        00:05:09 apt-get autoremove -y

Answer 5

If there's a single process with a given name (e.g. openvpn) on the host, you can do:

ps -p `pgrep openvpn` -o lstart=

Answer 6

one way you can ps -f |grep <pid> as you said you the pid otherwise you can see in top also