How to get the start time of a long-running Linux process?

You can specify a formatter and use lstart, like this command:

ps -eo pid,lstart,cmd

The above command will output all processes, with formatters to get PID, command run, and date+time started.

Example (from Debian/Jessie command line)

$ ps -eo pid,lstart,cmd  PID CMD                                          STARTED    1 Tue Jun  7 01:29:38 2016 /sbin/init                      2 Tue Jun  7 01:29:38 2016 [kthreadd]                      3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]                   5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]                  7 Tue Jun  7 01:29:38 2016 [rcu_sched]                     8 Tue Jun  7 01:29:38 2016 [rcu_bh]                        9 Tue Jun  7 01:29:38 2016 [migration/0]                  10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                    11 Tue Jun  7 01:29:38 2016 [netns]                       277 Tue Jun  7 01:29:38 2016 [writeback]                   279 Tue Jun  7 01:29:38 2016 [crypto]                          ...

You can read ps's manpage or check Opengroup's page for the other formatters.

The ps command (at least the procps version used by many Linux distributions) has a number of format fields that relate to the process start time, including lstart which always gives the full date and time the process started:

# ps -p 1 -wo pid,lstart,cmd  PID                  STARTED CMD    1 Mon Dec 23 00:31:43 2013 /sbin/init# ps -p 1 -p $$ -wo user,pid,%cpu,%mem,vsz,rss,tty,stat,lstart,cmdUSER       PID %CPU %MEM    VSZ   RSS TT       STAT                  STARTED CMDroot         1  0.0  0.1   2800  1152 ?        Ss   Mon Dec 23 00:31:44 2013 /sbin/initroot      5151  0.3  0.1   4732  1980 pts/2    S    Sat Mar  8 16:50:47 2014 bash

For a discussion of how the information is published in the /proc filesystem, seehttps://unix.stackexchange.com/questions/7870/how-to-check-how-long-a-process-has-been-running

(In my experience under Linux, the time stamp on the /proc/ directories seem to be related to a moment when the virtual directory was recently accessed rather than the start time of the processes:

# date; ls -ld /proc/1 /proc/$$ Sat Mar  8 17:14:21 EST 2014dr-xr-xr-x 7 root root 0 2014-03-08 16:50 /proc/1dr-xr-xr-x 7 root root 0 2014-03-08 16:51 /proc/5151

Note that in this case I ran a "ps -p 1" command at about 16:50, then spawned a new bash shell, then ran the "ps -p 1 -p $$" command within that shell shortly afterward....)

As a follow-up to Adam Matan's answer, the /proc/<pid> directory's time stamp as such is not necessarily directly useful, but you can use

awk -v RS=')' 'END{print $20}' /proc/12345/stat

to get the start time in clock ticks since system boot.¹

This is a slightly tricky unit to use; see also convert jiffies to seconds for details.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }    END { printf "%9.0f\n", now - ($20/ticks) }' /proc/uptime RS=')' /proc/12345/stat

This should give you seconds, which you can pass to strftime() to get a (human-readable, or otherwise) timestamp.

awk -v ticks="$(getconf CLK_TCK)" 'NR==1 { now=$1; next }    END { print strftime("%c", systime() - (now-($20/ticks))) }' /proc/uptime RS=')' /proc/12345/stat

Updated with some fixes from Stephane Chazelas in the comments; thanks as always!

If you only have Mawk, maybe try

awk -v ticks="$(getconf CLK_TCK)" -v epoch="$(date +%s)" '  NR==1 { now=$1; next }  END { printf "%9.0f\n", epoch - (now-($20/ticks)) }' /proc/uptime RS=')' /proc/12345/stat |xargs -i date -d @{}

¹ man proc; search for starttime.