3

I am trying to understand why ps does not behave the way I expect it to. From the man pages, the following command should display ppid and lstart, with items sorted by lstart order. However when I run the same command in three different terminals:

First term:

gauthier@sobel:~/ $ ps -o ppid -o lstart --sort=lstart
 PPID                  STARTED
21142 Tue Dec 16 13:45:18 2014
 3383 Mon Dec 15 15:40:35 2014

Second term:

gauthier@sobel:~/bin $ ps -o ppid -o lstart --sort=lstart
 PPID                  STARTED
19595 Tue Dec 16 13:45:03 2014
 3383 Mon Dec 15 14:49:14 2014

Third term:

gauthier@sobel:~ $ ps -o ppid -o lstart --sort=lstart
 PPID                  STARTED
 3383 Tue Dec 16 13:39:05 2014
16357 Tue Dec 16 13:45:12 2014

There are several things I don't understand here.

  • items in terms 1 and 2 are sorted most recent first. Items in term 3 are sorted oldest first. Even considering alphabetical order the orders differ.

  • PPID 3383 is the same for all three terms, but at different start times. It seems that several distinct PPID might be the same although they are different processes?


System info:

$ ps -V
procps-ng version 3.3.9
$ uname -a
Linux sobel 3.13.0-37-generic #64-Ubuntu SMP Mon Sep 22 21:28:38 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
  • PPID is the parent PID. A process can spawn any number (within limits) of child processes pretty much any time it wants. You're showing the parent PID but the child start time. – Mat Dec 16 '14 at 13:12
  • Oh, that makes sense! Still, the dates are not sorted the same in all three cases. – Gauthier Dec 16 '14 at 13:24
  • Yes, sort order is strange. Can you specify what OS & version of ps you have? (ps -V) – Mat Dec 16 '14 at 13:25
  • Edited to add system info. – Gauthier Dec 16 '14 at 13:30
4

ps --sort=lstart doesn't actually sort by lstart, According to this serverfault comment:

lstart gives a full timestamp, but cannot be used as a sort key. start_time gives the usual 'time within the last 24 hours, date otherwise' column, and can be used as a sort key.

This is implicitly documented in ps's man pages, where lstart is not listed under the OBSOLETE SORT KEYS section, but start_time is.

The source code also backs this up, see this definition starting on line 1506:

/* Many of these are placeholders for unsupported options. */
static const format_struct format_array[] = {
/* code       header     print()      sort()    width need vendor flags  */
[...]
{"lstart",    "STARTED", pr_lstart,   sr_nop,    24,   0,    XXX, ET|RIGHT},
[...]
{"start_time", "START",  pr_stime,    sr_start_time, 5, 0,   LNx, ET|RIGHT},
[...]
};

Edit: expanded on the explanation on the right answer, and removed the misleading part of the original one.

  • Interesting. I wonder what weird internal format is used to store lstart, that doesn't make sorting the chronological order. The serverfault comment was the solution (using start_time instead of lstart). Quote this in your answer and I'll accept it! Thanks! – Gauthier Dec 16 '14 at 14:43
  • Actually the bit about the output formatting was a red herring. I edited my answer to contain only the part about the unusable sort comparison. – Robert Dec 16 '14 at 15:29
0

I try on my gnu/gentoo, no such problem, here it is:

 ~ # ps -o ppid -o lstart --sort=lstart
 PPID                  STARTED
 3851 Mon Dec 15 21:25:51 2014
 4037 Mon Dec 15 21:25:52 2014
 4042 Tue Dec 16 22:02:24 2014
 ~ # ps -o ppid -o lstart --sort=lstart
 PPID                  STARTED
 3851 Mon Dec 15 21:25:51 2014
 4037 Mon Dec 15 21:25:52 2014
 4042 Tue Dec 16 22:02:25 2014
 ~ # ps -o ppid -o lstart --sort=lstart
 PPID                  STARTED
 3851 Mon Dec 15 21:25:51 2014
 4037 Mon Dec 15 21:25:52 2014
 4042 Tue Dec 16 22:02:26 2014
 ~ # ps -V
procps-ng version 3.3.9
 ~ # uname -a
Linux  3.12.21-gentoo-r1 #9 SMP Fri Nov 28 18:59:44 CST 2014 i686 Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz GenuineIntel GNU/Linux
  • Aren't you running these in a single terminal? All the PPIDs and start dates are the same. – Gauthier Dec 16 '14 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.