Determining when a specific process started is a common task for Linux system administrators and developers. Whether you're debugging performance issues, monitoring system resources, or investigating suspicious activity, knowing the process start time can be crucial.

The most straightforward way to check process start time is using the ps command with the -o lstart option:

ps -p [PID] -o lstart

For example, if you want to check process with PID 1234:

ps -p 1234 -o lstart
STARTED
Mon Oct  9 14:30:22 2023

Linux offers several format options for displaying process start time:

ps -p [PID] -o start,lstart,stime

Output explanation:

• start: Process start time in HH:MM:SS format
• lstart: Full date/time of process start
• stime: Date or time if process started same day

For more detailed information, you can examine the process's entry in the /proc filesystem:

ls -ld /proc/[PID]

The creation time of the directory corresponds to when the process started. You can also get precise information:

cat /proc/[PID]/stat | cut -d' ' -f22

This gives you the start time measured in jiffies since system boot, which you can convert to human-readable format.

If you need to know how long a process has been running rather than its absolute start time:

ps -p [PID] -o etime

Example output:

    ELAPSED
    3-12:30:45

This indicates the process has been running for 3 days, 12 hours, 30 minutes, and 45 seconds.

For systems using systemd, you can get more comprehensive process information:

systemctl show [PID] --property=ExecMainStartTimestamp

Here's a simple bash script to monitor process start times:

#!/bin/bash

if [ -z "$1" ]; then
    echo "Usage: $0 PID"
    exit 1
fi

PID=$1
if [ ! -d "/proc/$PID" ]; then
    echo "Process $PID does not exist"
    exit 1
fi

START_TIME=$(date -d @$(stat -c %Y /proc/$PID))
echo "Process $PID started at: $START_TIME"

---

When debugging or monitoring system performance, knowing exactly when a specific process started can be crucial. Linux provides several methods to check process start time using the process ID (PID). This information is particularly useful for:

• Performance analysis
• Debugging zombie processes
• System monitoring
• Security auditing

The most straightforward approach is using the ps command with process statistics formatting:

ps -p [PID] -o lstart,cmd

For example, to check process 1234:

ps -p 1234 -o lstart,cmd

This outputs:

STARTED CMD
Tue Mar 14 10:30:45 2023 /usr/bin/python3 /app/server.py

Linux stores process information in the /proc filesystem. You can find the start time in seconds since the epoch:

cat /proc/[PID]/stat | cut -d' ' -f22

To convert this to human-readable format:

date -d @$(awk '{print $22}' /proc/1234/stat)

For processes managed by systemd, you can get detailed timing information:

systemctl show [SERVICE] --property=ExecMainStartTimestamp

Example output:

ExecMainStartTimestamp=Wed 2023-03-15 08:45:23 UTC

To see the complete process tree with timing information:

ps -eo pid,lstart,cmd --forest

This displays all processes in a tree format with their start times.

Here's a bash script to monitor process start times periodically:

#!/bin/bash
PID=$1
INTERVAL=5

while true; do
    START_TIME=$(ps -p $PID -o lstart=)
    echo "[$(date)] Process $PID started at: $START_TIME"
    sleep $INTERVAL
done

Understanding process start times is fundamental for system administrators and developers. The methods shown provide flexibility depending on your specific needs, from quick command-line checks to automated monitoring solutions.