10

I'm using a ps command as part of an exercise to identify processes running longer than a given threshold.

I'm using the following template to get the elapsed time for a know process command:

ps -eo etime,command | grep <something to identify a process> | grep -v grep | awk '{print $1}'

I notice with short-running processes, the etime (elapsed time) value takes the format minutes:seconds and from this I can easily determine how long a process has been running.

For very long running processes (days long), I don't understand the format.

I have a MySQL server process that htop shows as running for 126 hours.

Executing ps -eo etime,command | grep mysql | grep -v grep | awk '{print $1}' gives me a value of 9-03:35:32.

My best guess is that this means 9 something, 3 hours, 35 minutes, 32 seconds. I can't figure out what the units are for the 9.

The process in question has been running 126 hours, about 5.25 days. This suggests that the 9 in the above output does not represent days. They can't be half days either as (9 * 12) hours + 3 hours + 35 minutes + 32 seconds is less than 5 days.

How do I interpret the elapsed time value I am seeing for long-running processes? What units accompany the 9 in the above output?

2
  • Here, you're seeing the POSIX time format. Minutes:seconds is the BSD time format. Linux's ps displays one or the other depending on the options you pass. Commented Nov 1, 2012 at 17:22
  • To double-check, try etimes instead of etime and compare the results.
    – Ruslan
    Commented Jul 29, 2018 at 19:34

1 Answer 1

19

According to the standard:

In the POSIX locale, the elapsed time since the process was started, in the form:

[[dd-]hh:]mm:ss

where dd shall represent the number of days, hh the number of hours, mm the number of minutes, and ss the number of seconds. The dd field shall be a decimal integer. The hh, mm, and ss fields shall be two-digit decimal integers padded on the left with zeros.

So, the 9 means days, whether you believe it or not. Could you be misinterpreting the output from htop? What does top (which has a time format of minutes:seconds) say? Are you certain that the field you are looking at in htop is equivalent to etime? (for example, could it means 126 minutes of CPU time?)

2
  • Thanks for the confirmation. htop is definitely showing 126 hours, but I think this might not be wall time but some other time (perhaps CPU time). The field in htop is not equivalent to etime, I assumed wrongly here.
    – Jon Cram
    Commented Nov 1, 2012 at 12:18
  • 1
    @JonCram Are you sure it's hours? Original top only shows minutes (i.e. it will go to minutes above 60 rather than breaking up to hours), a number like 126:37 means 126 minutes and 37 seconds. I was thinking htop might be the same. 126 hours of CPU time in 9 days seems like a lot.
    – Random832
    Commented Nov 1, 2012 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .