Linux ps 命令查看進程啟動及運行時間

引言

同事問我怎樣看一個進程的啟動時間和運行時間，我第一反應當然是說用 ps 命令啦。
ps aux或ps -ef不就可以看時間嗎？

ps aux選項及輸出說明

我們來重新復習下ps aux的選項，這是類 BSD 風格的命令選項，因為不帶“-”。

通過 man 可以看到 aux 選項解釋如下：

a      Lift the BSD-style "only yourself" restriction, which is imposed upon the set of all processes 
when some BSD-style (without "-") options are used or when the ps personality setting is BSD-like.  
The set of processes selected in this manner is in addition to the set of processes selected by other means.
An alternate description is that this option causes ps to list all processes with a terminal (tty), 
or to list all processes when used together with the x option.

x      Lift the BSD-style "must have a tty" restriction, which is imposed upon the set of all processes 
when some BSD-style (without "-") options are used or when the ps personality setting is BSD-like.  
The set of processes selected in this manner is in addition to the set of processes selected by other means.  
An alternate description is that this option causes ps to list all processes owned by you (same EUID as ps), 
or to list all processes when used together with the a option.

u      Display user-oriented format.
              

然后再來看下ps aux的輸出結果，其首行如下，說明了輸出的各列：

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND

我們可以看到START和TIME列，通過 man 其說明如下：

bsdstart    START     time the command started.  
If the process was started less than 24 hours ago, the output format is " HH:MM", 
else it is " Mmm:SS" (where Mmm is the three letters of the month). 
See also lstart, start, start_time, and stime.

bsdtime     TIME      accumulated cpu time, user + system.  
The display format is usually "MMM:SS", 
but can be shifted to the right if the process used more than 999 minutes of cpu time.

START 是命令啟動的時間，如果在 24 小時之內啟動的，則輸出格式為”HH:MM”（小時：分鍾），
否則就是”Mmm:SS”（月份英語單詞前 3 個字母：一月的第幾號？[SS 這里面怎么理解？為什么有冒號呢？輸出並沒冒號]） 可以知道，這里並不能直接看出 24 小時之前啟動的命令的精確啟動時間。

TIME 是累積的 CPU 時間（user+system），顯示格式通常是”MMM:SS”。（分鍾：秒） 可以看出，這里並不是指從命令啟動開始到現在所花的時間。

ps -ef選項及輸出說明

帶一個“-”為 UNIX 風格的命令選項。

-e     Select all processes.  Identical to -A.

-f     Do full-format listing. 
This option can be combined with many other UNIX-style options to add additional columns.  
It also causes the command arguments to be printed.  
When used with -L, the NLWP (number of threads) and LWP (thread ID) columns will be added.  
See the c option, the format keyword args, and the format keyword comm.

-o format     User-defined format.  
format is a single argument in the form of a blank-separated or comma-separated list, 
which offers a way to specify individual output columns.  
The recognized keywords are described in the STANDARD FORMAT SPECIFIERS section below.  

Headers may be renamed (ps -o pid,ruser=RealUser -o comm=Command) as desired.  
If all column headers are empty (ps -o pid= -o comm=) then the header line will not be output.  
Column width will increase as needed for wide headers; 
this may be used to widen up columns such as WCHAN (ps -o pid,wchan=WIDE-WCHAN-COLUMN -o comm).  
Explicit width control (ps opid,wchan:42,cmd) is offered too.  
The behavior of ps -o pid=X,comm=Y varies with personality; 
output may be one column named "X,comm=Y" or two columnsnamed "X" and "Y".  
Use multiple -o options when in doubt.  
Use the PS_FORMAT environment variable to specify a default as desired; 
DefSysV and DefBSD are macros that may be used to choose the default UNIX or BSD columns.              

然后再來看下ps -ef的輸出結果，其首行如下，說明了輸出的各列：

UID        PID  PPID  C STIME TTY          TIME CMD

我們可以看到 STIM E和 TIME 列，通過 man 其說明如下 (我這台服務器上 ps 版本為 procps-ng version 3.3.9，man 中找不到 STIME 的解釋，通過觀察輸出，
我們可以推斷這個 STIME 其實和前面 START 是一樣的，指的是命令啟動的時間，這里有這個說明）：

TIME 列也和前面說的 TIME 列一樣指的命令使用的累積 CPU 時間。

使用 ps 命令查看進程啟動的精確時間和啟動后所流逝的時間

回到引言中的問題，同事實際要問的是一個進程啟動的精確時間和進程啟動后所流逝的時間。
其實這 2 個時間也是可以通過 ps 命令輸出的。 標識符如下：

       lstart      STARTED   time the command started.  See also bsdstart, start, start_time, and stime.
       etime       ELAPSED   elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.

例子：

查看 nginx 進程啟動的精確時間和啟動后所流逝的時間：

[root@iZ25p102vo3Z ~]# ps -eo pid,lstart,etime,cmd | grep nginx
16968 Fri Mar  4 16:04:27 2016 41-21:14:04 nginx: master process /usr/sbin/nginx
17826 Fri Mar  4 22:53:51 2016 41-14:24:40 nginx: worker process
18312 Fri Apr 15 13:18:31 2016       00:00 grep --color=auto nginx