List processes that have been running more than 2 hours

Question

How can I list processes, with a defined name, that have been running for more than 2 hours. This is what I have tried.

ps -efo pid,comm,etime | grep 'process name' | awk '{print $3}' 

---

This is for Solaris.

Or can someone help how to create a script that will send an email with the process IDs if there are processes running longer than 2 hours.

Answer 1

One liner to find processes that have been running for over 2 hours

ps -e -o pid,etimes,command | awk '{if($2>7200) print $0}'

Explanation:

ps: process snapshot command

-e: list all processes

-o: include only specified columns

pid: process id

etimes: elapsed time since the process was started, in seconds

command: command with all its arguments as a string

awk: pattern scanning and processing language

$2: second token from each line (default separator is any amount of whitespace)

7200: 7200 seconds = 2 hours

$0: the whole line in awk

Since the default action in the pattern { action } structure in awk is to print the current line, this can be shortened to:

ps -e -o pid,etimes,command | awk '$2 > 7200'

More:

man ps
man awk

Answer 2

Something I wrote a couple years ago. This looks for the app name listed in progname variable and will kill it if older than value in killtime variable (in seconds). You will have to change the progname to match the process name returned with ps -o comm You will also have to change the value in killtime to match the number of seconds you want. Can fire from a cronjob to inspect every so often.

Be sure you know what all of this does before you run it or it may kill unexpected processes.

This works in RHEL 7.x so not positive about Solaris but they are very close so it may work with little or no adjustments. If there are formatting errors I apologize. Had some leftover formatting mess I had to clean up.

###With email send on process kill
#!/bin/bash ############################################################################## #  Name: checkRunawaProgram.sh
 #  Version: 1.0
 #  Date: 10/07/2015
 #  Author: Mark S
 #  Description: check processes for a named command and if older than a specified time in seconds kill the process.
 #Note about time: If killtime is over 60 seconds it will be off by 40 seconds.
 #  Example: ./checkRunawaProgram.sh fire off from cronjob or run manually
 #NOTE: adjust the progname and killtime fields for your file and delay time.
 # and adjust email address to your addr. 
 #EDITED By-On-Why
 #Mark-10/08/15-Clean up and add variables progname and killtime
#Mark-10/9/15 Add email and logger 
#
##############################################################################
progname=runawaProgram.sh
killtime=50
ps -o uname,pid,etime,comm -C $progname \
| while read user pid elapsed comm
         do
         echo etime $elapsed
         echo pid $pid
         #Strip off : from elapsed and store in elapsed1
         elapsed1=${elapsed//[:]/}
         echo elapsed1 $elapsed1
         if [ ${elapsed1} -gt ${killtime} ]
         then
         echo greater than 10 on pid $pid
         echo killing pid $pid
         kill $pid ## ##email Variables
 now=`date`
 subject="es-ppscnftp01 cron killing process  $pid"
 varHost=`hostname`
 sendTo="[email protected]"
 mail -s "$subject" "$sendTo" << END_MAIL
 From $varHost
 The process ID $pid was killed
the process name was $comm
END_MAIL
#send info to /var/log/messages
 logger The cronjob checkRunawaProgram.sh killed the $pid process for Process name $comm
 fi
 done