The command 'ps' gives current status of the processes. Is there any way to find the status of a particular process in the past: say I would like to know the status of a particular process 48 hours before from now?

I have a unit crashing and wanted to know the status of different processes during the exact time when the crash occurred.

  • 1
    Unless you have already set up monitoring on the process the answer is no. – Raman Sailopal Dec 1 '17 at 9:05
  • @Raman Sailopal No, I do not have any monitoring setup for the processes. Following command gives the uptime of the process: ls -al /proc | grep <Process id> But need to know the state of the process at a older time. – Ravi Dec 1 '17 at 9:15
  • Is the past in the future? – Volker Siegel Oct 3 '18 at 21:57

No, commands such ps and top show only the current status of processes. There's no way to know what the process status was in the past unless you already set up a monitoring system.

For the future, you can set up atop to log process status. From its manpage:

In order to store system- and process level statistics for long-term analysis (e.g. to check the system load and the active processes running yesterday between 3:00 and 4:00 PM), atop can store the system- and process level statistics in compressed binary format in a raw file with the flag -w followed by the filename. If this file already exists and is recognized as a raw data file, atop will append new samples to the file (starting with a sample which reflects the activity since boot); if the file does not exist, it will be created.

By default only processes which have been active during the interval are stored in the raw file. When the flag -a is specified, all processes will be stored. The interval (default: 10 seconds) and number of samples (default: infinite) can be passed as last arguments. Instead of the number of samples, the flag -S can be used to indicate that atop should finish anyhow before midnight.

Clearly, and as already said, atop will start recording only from the moment you set it up.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.