3 ways to check process start time in Linux

Sometimes you need to know exactly when a process began running on Linux.

Maybe the system feels slow. Maybe you’re tracing a bug. Or maybe you just want to confirm when a service started.

Here are three quick ways to get that information.

Method 1: The Quick Glance with the ps Command

The ps (process status) command is your go-to tool for a quick snapshot of what’s currently running on your system. It’s like taking a quick photo of all the active tasks.

To get started, open your terminal and try this simple command:

ps -eo pid,lstart,cmd

This command tells ps to show you a custom list with the Process ID (PID), the exact start time, and the name of the command that’s running.

If you want to zero in on a specific program, you’ll first need its PID. A PID is just a unique number that Linux gives to every process. You can often find it by running ps aux | grep [program name]. Once you have the PID, you can get more detailed timing information.

Let’s say the PID you’re interested in is 1234. You could run:

ps -p 1234 -o lstart,etime,etimes

Here’s what that new alphabet soup means:

• lstart: Shows the exact date and time the process began.
• etime: Displays the elapsed time since the process started, in a human-readable format like DD-hh:mm:ss (days-hours:minutes:seconds).
• etimes: Gives you that same elapsed time, but just in seconds, which can be super useful for scripts.

This is a fantastic way to get a quick and detailed look at a specific process without a lot of fuss.

Method 2: Digging a Little Deeper with the /proc Filesystem

For those who like to get a bit more hands-on, the /proc filesystem is a treasure trove of information. It’s a special, virtual filesystem that holds all sorts of details about your system and the processes running on it. Think of it as the backstage area of your operating system.

Every process running on your system has its own directory inside /proc, named after its PID. To find out when a process started, you can check the creation date of its directory.

For a process with PID 1, which is typically the systemd or init process that kicks everything off, you could use this command:

ls -ld /proc/1

The output will show you the date and time the directory was created, which corresponds to when the process started. This method is great for getting a quick, approximate start time and for understanding the underlying structure of how Linux manages processes.

Method 3: Real-Time Monitoring with the top Command

If you’re looking for a more dynamic, real-time view of your processes, the top command is your best friend.

It provides a continuously updated list of your running programs, sorted by how much CPU they’re using.

It’s like having a live dashboard for your system’s performance.

Simply type top into your terminal to get started. While top is excellent for seeing what’s happening right now, it’s important to know how it differs from ps.

The ps command gives you a static snapshot, while top is all about live updates.

In the top interface, you can see a “TIME+” column, which shows the total CPU time a process has used since it started. This isn’t the same as the elapsed time you get with ps, but it’s very useful for spotting programs that are hogging your processor.

Which Method Should You Use?

• For a quick and detailed start time of a specific process, the ps command is your best bet.
• If you’re curious about the underlying system files or want a fast, high-level timestamp, exploring the /proc filesystem is a great approach.
• When you need to monitor your system in real-time and see which processes are most active, fire up the top command.

We hope this gives you a clearer picture of how to check up on the processes running on your Linux system. If you have any questions or your own favorite methods, feel free to share them in the comments below.