6

How can I list processes, with a defined name, that have been running for more than 2 hours. This is what I have tried.

ps -efo pid,comm,etime | grep 'process name' | awk '{print $3}' 

This is for Solaris.

Or can someone help how to create a script that will send an email with the process IDs if there are processes running longer than 2 hours.

3
  • What do you mean by "longer than 2 hours"? Wall-clock time since the process was started? CPU time consumed? Jul 19, 2019 at 15:34
  • The paragraph at the end seems like a completely different question. You should ask in a different question. (and remove from here) Jul 19, 2019 at 16:37
  • The modification time of /proc/[PID] is going to be the time the process started. I tried to see if some variation of find /proc \! -mmin 120 ... would work, but wasn't able to come up with a proper find command that would limit the depth of the search to just the /proc/[PID] level in the limited time I had. Someone with better skill with find can probably solve the problem easily. Note that you will pick up a lot of OS processes that you really don't want to kill. Jul 22, 2019 at 9:33

2 Answers 2

11

One liner to find processes that have been running for over 2 hours

ps -e -o pid,etimes,command | awk '{if($2>7200) print $0}'

Explanation:

ps: process snapshot command

-e: list all processes

-o: include only specified columns

pid: process id

etimes: elapsed time since the process was started, in seconds

command: command with all its arguments as a string

awk: pattern scanning and processing language

$2: second token from each line (default separator is any amount of whitespace)

7200: 7200 seconds = 2 hours

$0: the whole line in awk

Since the default action in the pattern { action } structure in awk is to print the current line, this can be shortened to:

ps -e -o pid,etimes,command | awk '$2 > 7200'

More:

man ps
man awk
1
  • For older ps versions without -o etimes to get seconds, answers from this post can be used.
    – thanasisp
    Jun 7, 2022 at 17:09
-1

Something I wrote a couple years ago. This looks for the app name listed in progname variable and will kill it if older than value in killtime variable (in seconds). You will have to change the progname to match the process name returned with ps -o comm You will also have to change the value in killtime to match the number of seconds you want. Can fire from a cronjob to inspect every so often.

Be sure you know what all of this does before you run it or it may kill unexpected processes.

This works in RHEL 7.x so not positive about Solaris but they are very close so it may work with little or no adjustments. If there are formatting errors I apologize. Had some leftover formatting mess I had to clean up.

###With email send on process kill
#!/bin/bash ############################################################################## #  Name: checkRunawaProgram.sh
 #  Version: 1.0
 #  Date: 10/07/2015
 #  Author: Mark S
 #  Description: check processes for a named command and if older than a specified time in seconds kill the process.
 #Note about time: If killtime is over 60 seconds it will be off by 40 seconds.
 #  Example: ./checkRunawaProgram.sh fire off from cronjob or run manually
 #NOTE: adjust the progname and killtime fields for your file and delay time.
 # and adjust email address to your addr. 
 #EDITED By-On-Why
 #Mark-10/08/15-Clean up and add variables progname and killtime
#Mark-10/9/15 Add email and logger 
#
##############################################################################
progname=runawaProgram.sh
killtime=50
ps -o uname,pid,etime,comm -C $progname \
| while read user pid elapsed comm
         do
         echo etime $elapsed
         echo pid $pid
         #Strip off : from elapsed and store in elapsed1
         elapsed1=${elapsed//[:]/}
         echo elapsed1 $elapsed1
         if [ ${elapsed1} -gt ${killtime} ]
         then
         echo greater than 10 on pid $pid
         echo killing pid $pid
         kill $pid ## ##email Variables
 now=`date`
 subject="es-ppscnftp01 cron killing process  $pid"
 varHost=`hostname`
 sendTo="[email protected]"
 mail -s "$subject" "$sendTo" << END_MAIL
 From $varHost
 The process ID $pid was killed
the process name was $comm
END_MAIL
#send info to /var/log/messages
 logger The cronjob checkRunawaProgram.sh killed the $pid process for Process name $comm
 fi
 done
2
  • 1
    The "something you wrote" is missing? Jul 19, 2019 at 17:26
  • Yes I had serious formatting issues when I tried to post code. Cleaned up and now posted. :D Jul 19, 2019 at 17:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .