Check the program start time

Posted on 2011-03-16
Last Modified: 2012-05-11
Hi, I run an application program yesterday, it is still running today. I want to know when the program begun. Is there a command for that?

Question by:zhshqzyc
  • 4
  • 3
LVL 68

Expert Comment

ID: 35149022
ps -fo etime -p pid_of_your_process

This will show you the elapsed time as


so you can easily calculate the start time.

I assume you know how to get the PID of a running process?


Author Comment

ID: 35149088
But I don't know how to get the pid? Please advise me.
LVL 68

Expert Comment

ID: 35149127
Take the second column of

ps -ef | grep programname

I just hope you do know the name of your program (at least part of it) 'coz I will not be able to help you there.
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.


Author Comment

ID: 35149250
[testme@saguaro4 ~]$ ps -ef | grep saguaro
markv    12557 12530  0 Feb16 pts/8    00:13:49 emacs -cr maroon -ms blue -bg gray20 -fg grey90 -geometry 73x77+507+0 -font -misc-fixed-medium-r-normal--14-*-*-*-*-*-iso8859-1 -name saguaro emacs
testme   15128  5776  0 09:00 pts/4    00:00:00 grep saguaro
[testme@saguaro4 ~]$ 

Open in new window

The program is called "saguaro", so is the pid=15128?
LVL 68

Accepted Solution

woolmilkporc earned 50 total points
ID: 35149270
No, that's the PID of your "grep" search.

The PID is 12557

Author Comment

ID: 35323797
Can we  just use one line or a batch file to get it?
LVL 68

Expert Comment

ID: 35324669
You asked for it!

Save the following script in a file named e.g. pstime, issue "chmod +x pstime".

Now determine the id of the process in question (PID) and run the script with

pstime PID


pstime 12557

ETIME=$(ps -f -o etime= -p $1)
if [[ -z $ETIME ]]; then
 echo "Process does not exist!"
   echo "Start Time of Process with PID $1 is:"
    if echo $ETIME | grep -q "-" ; then
     date -d "01/01/1970+$(($(date +%s)-$(echo $ETIME | awk -F"[:-]" '{print ($1*86400)+($2*3600)+($3*60)+$4}'))) seconds"
     date -d "01/01/1970+$(($(date +%s)-$(echo $ETIME | awk -F"[:]" '{print ($1*3600)+($2*60)+$3}'))) seconds"

Open in new window


Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Have you ever been frustrated by having to click seven times in order to retrieve a small bit of information from the web, always the same seven clicks, scrolling down and down until you reach your target? When you know the benefits of the command l…
The purpose of this article is to fix the unknown display problem in Linux Mint operating system. After installing the OS if you see Display monitor is not recognized then we can install "MESA" utilities to fix this problem or we can install additio…
Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now