Check Process Start Time in Linux

Updated 7 November 2026 · Standard formula, shown below

To check when a process started in Linux, use the ps command with the lstart or etimes option, or read the /proc/[pid]/stat file. The most direct way is ps -o pid,lstart,cmd -p PID, which shows the full start date and time for a specific process. This article explains the various methods, their output formats, and how to interpret them.

Why Process Start Time Matters

Knowing when a process started helps you diagnose issues like unexpected restarts, identify long-running daemons, and correlate system events with application behavior. For example, if a service crashed and was restarted by a supervisor, the start time reveals exactly when that happened. It also helps in capacity planning and auditing—you can see which processes have been running since boot and which are recent.

The `ps` Command: Your Primary Tool

The ps command is the standard utility for inspecting processes. Its output can be customized with the -o option to show specific fields. The most useful fields for start time are:

lstart: full start date and time (e.g., Mon Mar 4 10:22:33 2025)
start: abbreviated start time (e.g., 10:22 or Mar04)
etimes: elapsed time in seconds since start
etime: elapsed time in human-readable format (e.g., 3-02:15:01)

To see the start time of a specific process by PID, use:

ps -p 1234 -o pid,lstart,cmd

To see all processes with their start times, use:

ps -eo pid,lstart,cmd

Reading the `/proc` Filesystem

Linux exposes process information in the virtual /proc directory. Each running process has a subdirectory named after its PID. The stat file contains many fields; the 22nd field is the start time in clock ticks since boot. To convert this to a human-readable date, you need the system’s boot time and clock tick rate.

Get the boot time (in seconds since epoch) from /proc/stat (field btime)
Get the clock tick rate (usually 100) from getconf CLK_TCK
Read the 22nd field from /proc/[pid]/stat
Calculate: start_seconds = btime + (field22 / CLK_TCK)

Here is a one-liner that does this for a given PID:

awk '{print $22}' /proc/1234/stat | awk -v b=$(grep btime /proc/stat | awk '{print $2}') -v c=$(getconf CLK_TCK) '{print strftime("%Y-%m-%d %H:%M:%S", b + $1/c)}'

Comparing Methods: Which to Use?

Each method has its strengths:

ps lstart is the simplest and most readable; it works on any Linux distribution and is ideal for interactive use.
ps etimes gives elapsed seconds, which is useful for scripting and calculating uptime.
/proc parsing is more complex but is the underlying source and is useful when you need the raw value or when ps is not available (e.g., in minimal containers).

Common Pitfalls and Misconceptions

A frequent misunderstanding is that ps start shows the time the command was typed, not when the process actually started. In reality, it shows the time the process was created by the kernel. Also, for processes that are zombies (defunct), the start time may remain but the process is no longer running.

Another pitfall: when using ps -ef (a common default), the START column shows only the time (or date if the process is older than 24 hours), not the full date. To always see the full date, use lstart.

Finally, note that the start time is not affected by system clock changes. If you change the system time, the start time of existing processes remains the same in terms of elapsed time, but the displayed wall-clock time may shift because it is computed from the boot time and the tick counter.

Using Start Time for Troubleshooting

When investigating a problem, start times can reveal patterns:

If a service restarts frequently, its start time will be recent and you can correlate with log entries.
If a process has been running since boot, it may be a startup service that is not managed properly.
Comparing start times of related processes helps determine which one spawned another.

For example, to list all processes started in the last hour, you can use ps -eo pid,lstart,cmd and filter manually, or use ps -eo pid,etimes,cmd and check if etimes is less than 3600.

Frequently Asked Questions

How do I see the start time of all processes?

Use ps -eo pid,lstart,cmd to display the PID, full start date/time, and command for every process. This is the most comprehensive way to get a list with start times.

What is the difference between `start` and `lstart` in ps?

start shows a shortened, human-friendly format (e.g., 10:22 or Mar04), while lstart shows the full date and time including the year (e.g., Mon Mar 4 10:22:33 2025). For precise timestamps, always use lstart.

Can I get the start time of a process that has already exited?

No, once a process exits, its entry in /proc disappears. However, if you have process accounting enabled (via accton), you might find historical records, but that is not a standard feature. For most cases, you need to have captured the start time while the process was running.

Why does `ps -ef` show only the time and not the date?

The START column in ps -ef is designed to be compact: it shows the time if the process started today, or the date (e.g., Mar04) if it started on a previous day. To always get the full date, use ps -eo pid,lstart,cmd.

Is there a way to see the start time in a script-friendly format?

Yes, use ps -o lstart= -p PID to output only the start time with no header. For a Unix timestamp, you can use stat /proc/PID but that gives file access times, not process start. The most reliable script-friendly method is to parse /proc/[pid]/stat as described earlier.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.