How to check the processes running longer than 2 hours.?

UNIX for Beginners Q & A
1

HI

can someone help me to check the process running more than 2 hours.

I have the below command which shows the time and process id, however, I only need the processes running more than 2 hours.

2

What below command?

3 
ps -efo pid,comm,etime | grep 'processname' | awk '{print $1 $3}'
4

Try

ps -efo pid,comm,etimes | awk '$NF > 7200'
1 Like
5

I wonder what the -f does in conjunction with -o ...
"etime" is standard. With an appropriate RE:

ps -eo pid,comm,etime | awk '$3~/^[2-9][0-9]*-/{print $1,$2,$3}'
1 Like
6

Rudic, can you please explain this code... What is 7200means?

7

Hello Vinod,

When you see man page for ps you see like.

So Rudi's code is actually comparing if a process is older then 7200 seconds which is 2 hours and if condition is TRUE it prints it simply(which is your question too).

Thanks,
R. Singh

1 Like
8

Thank you, however, I'm not able to send get the output of the mentioned command.

bash-3.2# ps -efo pid,comm,etimes | awk '$NF > 7200'
ps: unknown output format: -o etimes
usage: ps [ -aAdeflcjLPyZ ] [ -o format ] [ -t termlist ]
        [ -u userlist ] [ -U userlist ] [ -G grouplist ]
        [ -p proclist ] [ -g pgrplist ] [ -s sidlist ] [ -z zonelist ]
  'format' is one or more of:
        user ruser group rgroup uid ruid gid rgid pid ppid pgid sid taskid ctid
        pri opri pcpu pmem vsz rss osz nice class time etime stime zone zoneid
        f s c lwp nlwp psr tty addr wchan fname comm args projid project pset

It is working when I remove 's' from etimes. But I'm not sure this is giving the correct output I need

bash-3.2# ps -efo pid,comm,etime | awk '$NF > 7200'
  PID COMMAND                                                                              ELAPSED
 7053 Command                                   96-00:56:14
17647 command                                    76-00:54:48
13030 command                                                              8-18:00:49
29871 command                                     73-00:53:42
25722 command                                    74-00:53:45
10527 command                                   86-23:52:54
27597command                                    86-21:12:59
13665 command                                    77-00:54:40
24848command                                     86-21:38:43

Also, Madeln can you please explain this command

ps -eo pid,comm,etime | awk '$3~/^[2-9][0-9]*-/{print $1,$2,$3}'
9

The awk checks field 3 (etime) against a regular expression (RE) that checks the digits before a - character. But - I misread your first post - that's days, not hours!
Also there is a bug in the RE, should be

ps -eo pid,comm,etime | awk '$3~/^([2-9]|[0-9][0-9]+)-/{print $1,$2,$3}'

A digit in the range [2-9] or two+ digits between the start of the field and a - character.
Still this is days.
For hours, the RE would become too complicated.
So here is another one that computes the time in seconds:

ps -e -o pid= -o comm= -o etime= | awk '{n=split($3,e,"[-:]"); elapsed=e[n]+60*(e[n-1]+60*(e[n-2]+24*e[n-3]))} elapsed>7200 {print $1,$2,$3,elapsed}'

The ps is a bit longer, omits the header in a portable way.
The awk splits the field 3 into an array, delimited by the RE [-:] (a - or a : character).
Then it multiplies the array elements, so the are in seconds. Stores the sum in the variable" elapsed".
Then print if "elapsed" is greater than 7200.
It prints all three fields from the ps command, plus the "elapsed" variable. Omit what you don't need!