A number of processes are continuously running on a Linux system. We ourselves can create a process and push it into the background, while we do something else on the terminal. Sometimes, we need to find out how long a particular process has been running. Perhaps we have a cron script that regularly checks the run time and performs some actions based on it. Most of us know about the “ps” command that gives us information about currently running processes with the “-ef” parameter like this:

ps -ef

This will give us a list of all the processes (-e) in a full format listing (-f). The end result looks like this:

Command to list all processes in Linux

In this example, you can see that each process has a column called “STIME”. This gives the date at which the process was started. If the process was started in the past 24 hours, it’ll give you the exact time with the hour and the minute. If it was started this year, it will show you the date as shown above. If it was started in a different year, then it shows you the year and not the date!

But sometimes you need the exact time and date when a process started. Regardless of situation. For example, if today’s the first day of the new year and you want to check the run time of a process that was started yesterday, it’ll give you a response that’s not helpful. In this tutorial, we’ll look at several ways to obtain the information that we want. We’ll also take into consideration the potential problem of time synchronization which can give you wrong answers about the start time of a process.

Modifying the “ps” Command to give Elapsed Time

Even though the default “ps” command doesn’t give us what we need, we can use the formatting options with the “etime” parameter to show us the time elapsed since a process started like this:

ps -e --format pid,cmd,etime

This will provide us with an output like this:

Command to show the elapsed time of each Linux process

This command shows us three things:

  1. The process ID;
  2. The command used to start the process;
  3. The elapsed time.

The third column might appear a bit strange to you. But it’s merely the POSIX standard for the display of time elapsed, as explained in the documentation. Here’s the relevant part:

In the POSIX locale, the elapsed time since the process was started, in the form:

[[dd-]hh:]mm:ss

where

dd will represent the number of days,
hh the number of hours,
mm the number of minutes, and
ss the number of seconds. The
dd field will be a decimal integer.

So going off this, it shows that the first process has been running for 33 days, 35 minutes, and 56 seconds.

You can even use the “lstart” parameter to get the exact date and time instead of the elapsed time like this:

ps -e --format pid,cmd,lstart

Which gives us:

Get the exact date and time of a Linux process

So here we have the exact date and time with ps.

Accounting for NTP Updates

Linux regularly synchronizes its clocks with Internet servers, and this can sometimes give you incorrect times using the two commands shown above. This is because the elapsed time and days calculations can be different before and after a clock update.

To solve this, we can get the start time in elapsed seconds instead. That will always be the same regardless of clock changes. We can get the number of seconds using the “etimes” field (note the extra “s”):

ps -e --format pid,cmd,etimes

This will output the elapsed time in seconds and give an output like this:

Now you can use whatever tool you want to convert it to elapsed days, hours and minutes!

These set of tools with the versatile “ps” command will give you all the information you need to accurately determine when a particular process started.


Stéphane Brault is a programmer and sysadmin with more than 24 years of experience. He’s the owner of WebHostingHero.com, a blog dedicated to website development and Linux server administration.