Print only processes running for more than 24 hours

Shell Programming and Scripting
1

How can I print ONLY processes running for more than 24 hours. Using ps command or any other method

I use this to get a whole list.

 ps -eo pid,pcpu,pmem,user,args,etime,cmd --sort=start_time

We can also sort the outout of the above command to list processes older than 24 hours using sed/awk.

2

Try this

ps -eo pid,pcpu,pmem,user,args,etime,cmd --sort=start_time | awk 'substr($0,54,2)>=24'

My PS get time at position 54, your my differ.

3

Jotne,

Thanks, but not getting correct result.

4 
ps -eo pid,etime,args | awk 'substr($2,1,index($2,"-")-1)>1'
5

Thanks, but not all process is showing up in result.

Is there a way to list with seconds elapsed since a process started, rather than like day-hour:minute:seconds

1 1-00:00:00 init [3]

Should be like below. The above process is running for 1 day, 0 hour, 0 minutes, 0 seconds. So total seconds it has been running is 86400 seconds. So the ps result should show like below.

86400 init [3]
6

Then let awk calculate that in seconds.

ps -eo pid,etime,args | awk '
(x=substr($2,1,i=index($2,"-")-1))>1 {
 y=substr($2,i+2); split(y,Y,":")
 $2=60*(60*(24*x+Y[1])+Y[2])+Y[3]
 print
}'
7

@anil510
Post the output of ps -eo pid,pcpu,pmem,user,args,etime,cmd --sort=start_time
This way we need not guess what you see.

8

@jotne,

can you please make me understand your awk part, it is not working for me. Below is out of command.


command

ps -eo pid,pcpu,pmem,user,args,etime,cmd --sort=start_time 


PID %CPU %MEM USER     COMMAND                         ELAPSED CMD
    1  0.0  0.0 root     /usr/lib/systemd/systemd       20:00:42 /usr/lib/systemd/systemd
    2  0.0  0.0 root     [kthreadd]                     20:00:42 [kthreadd]
    3  0.0  0.0 root     [ksoftirqd/0]                  20:00:42 [ksoftirqd/0]
    6  0.0  0.0 root     [migration/0]                  20:00:42 [migration/0]
    7  0.0  0.0 root     [watchdog/0]                   20:00:42 [watchdog/0]
    8  0.0  0.0 root     [migration/1]                  20:00:42 [migration/1]
   10  0.0  0.0 root     [ksoftirqd/1]                  20:00:42 [ksoftirqd/1]
   12  0.0  0.0 root     [watchdog/1]                   20:00:42 [watchdog/1]
   13  0.0  0.0 root     [cpuset]                       20:00:42 [cpuset]
   14  0.0  0.0 root     [khelper]                      20:00:42 [khelper]
   15  0.0  0.0 root     [kdevtmpfs]                    20:00:42 [kdevtmpfs]
   16  0.0  0.0 root     [netns]                        20:00:42 [netns]
   17  0.0  0.0 root     [sync_supers]                  20:00:42 [sync_supers]
   18  0.0  0.0 root     [bdi-default]                  20:00:42 [bdi-default]
   19  0.0  0.0 root     [kintegrityd]                  20:00:42 [kintegrityd]
   20  0.0  0.0 root     [kblockd]                      20:00:42 [kblockd]
   21  0.0  0.0 root     [ata_sff]                      20:00:42 [ata_sff]
   22  0.0  0.0 root     [khubd]                        20:00:42 [khubd]
   23  0.0  0.0 root     [md]                           20:00:42 [md]
   26  0.0  0.0 root     [kswapd0]                      20:00:42 [kswapd0]
   27  0.0  0.0 root     [ksmd]                         20:00:42 [ksmd]
   28  0.0  0.0 root     [khugepaged]                   20:00:42 [khugepaged]
   29  0.0  0.0 root     [fsnotify_mark]                20:00:42 [fsnotify_mark]
   30  0.0  0.0 root     [crypto]                       20:00:42 [crypto]
   36  0.0  0.0 root     [kthrotld]                     20:00:42 [kthrotld]
   45  0.0  0.0 root     [scsi_eh_0]                    20:00:42 [scsi_eh_0]
   46  0.0  0.0 root     [scsi_eh_1]                    20:00:42 [scsi_eh_1]
   47  0.0  0.0 root     [scsi_eh_2]                    20:00:42 [scsi_eh_2]
   48  0.0  0.0 root     [scsi_eh_3]                    20:00:42 [scsi_eh_3]
   49  0.0  0.0 root     [scsi_eh_4]                    20:00:42 [scsi_eh_4]
   50  0.0  0.0 root     [scsi_eh_5]                    20:00:42 [scsi_eh_5]
   53  0.0  0.0 root     [kworker/u:4]                  20:00:42 [kworker/u:4]
   56  0.0  0.0 root     [kpsmoused]                    20:00:42 [kpsmoused]
9

I would drop "cmd" from the format since it adds nothing not already provided by "args", leaving "etime" as the last field, which makes it easier to extract.

Regards,
Alister

10

This should work, but since none of your test data are more then 20 hour, it will output none.

ps -eo pid,pcpu,pmem,user,args,etime,cmd --sort=start_time | awk 'substr($0,57,2)+substr($0,54,2)*60>24'

You may tweak toe numbers to get correct result.