ps -ef |grep 24 hours

I need to grep PIDs older than 24 hours (1 day) or more.

ps -ef |grep ???

Please advise.

ps -ef | awk 'NR > 1 {split($7, a,":"); if ( a[1] > 24 ) print a[1]}'

$7 may not be your field record for the TIME value. Depending on your ps output you will need to change this.

  d_prod 1499142 5034194   0 16:00:47      -  0:00 /usr/bin/ksh /usr/lib/lpd/pio/etc/piojetd hgb-6kc-ps3 9100 -dp /var/spool/qdaemon/thX3b7a
  d_prod 3555364 5034194   0 16:01:08      -  0:00 /usr/bin/ksh /usr/lib/lpd/pio/etc/piojetd hgb-g5j34-ps1 9100 -d s /var/spool/qdaemon/tNPuiaa
  d_prod 5816482 5034194   0 16:01:02      -  0:00 /usr/bin/ksh /usr/lib/lpd/pio/etc/piojetd 3fens-ps1 9100 -dp /var/spool/qdaemon/tiL3pUa
    root 5034194  385266   0   Oct 26      -  4:39 /usr/sbin/qdaemon

The date and time format is a bit tricky, and are not being picked correctly.

Please advise.

Something like this?...

ps -ef | awk '{if(match($5,"(..):(..)")){print $0}}'

--ahamed

ps -ef | awk '$5 ~ /[[:alpha:]]+/ {print}'

(assuming you want all the older processes (that will have a date rather than a time) and not vice-versa.)

Updated the post! I thought less than 24 hours...

ps -ef | awk '{if(!match($5,"(..):(..)")){print $0}}'

--ahamed

From the 'ps' command man page:

If the process was started less than 24 hours ago, the output format is "HH:MM", else it is "mmm dd" (where mmm is the three letters of the month).

So grepping for that month and date combination should work:

ps -ef | grep '[A-Z][a-z][a-z][0-9][0-9]'

Hope this helps.

If its past a year, then it would display the year instead.

--ahamed

awk works very well for me.

On top of the awk syntax, I need to pull out the PIDs with "kill -9 PID" command.
I will manually execute "kill -9 PID" when needed.

Please advise how to add the below to the awk syntax.

|awk '{print "kill -9 "$2}'

ps -ef | awk '$5 ~ /[[:alpha:]]+/ {print "kill -9 "$2}'

or

ps -ef | awk '{if(!match($5,"(..):(..)")){print "kill -9 "$2}}'

etc.

(Although they won't actually kill anything. Which is probably a good thing!)

That works great! Thank you so much.