Is there a magic command in Linux for listing the processes active in the last past n seconds by CPU usage?

To clarify: Process A is launched and it takes 5 seconds to complete, about 5 more seconds go by, magic-command is launched to check processes over the last 20 seconds and its output lists Process A and the amount of CPU usage it had over the previous 20 seconds.

As far as I understand commands like top, ps or mpstat aren't going to inspect resources used before their launch and while find can report which files were used in the past in a scale of minutes or hours, I won't be able to read CPU use from that data.

I believe the only way to do this is to start monitoring resource usage before the events I want to measure take place, am I wrong?

  • 1
    Unless there is a scheduler "callback" that allows you to trigger specific actions whenever a thread is scheduled (and for performance reasons there is none obviously), you are right (there is no other way) IMHO.
    – U. Windl
    Commented Sep 6, 2021 at 22:28

1 Answer 1


The systat family of utilities does this sort of thing through process accounting.

For long term historical and statistical analysis, you have to enable the process accounting system, see this answer. Once you have enabled process accounting, you can use commands like sadf to extract and summarize statistics.

More immediate tools in the sysstat package include pidstat which can give you process activity while it is running.

  • do you mean that I should set sar to collect statistics every n seconds to a file and access those files to get what I need?
    – maja
    Commented Sep 6, 2021 at 8:57
  • 1
    Yes, except that it's already set up, you just have to install and enable it.
    – user10489
    Commented Sep 6, 2021 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .