How to sort ps output by process start time?

linux mac-osx unix command-line-interface process

102,314

Solution 1

This should work on Linux and SysV5

ps -ef --sort=start_time

Solution 2

Linux:

$ ps aux --sort=lstart

OSX:

$ ps aux -O started

Solution 3

Along with the great answers above, sometimes I just want to see the top 20 offenders by process sorted descending by time, cpu% and memory usage.

For that I use:

ps auxww --sort=lstart | sort -r -k3,4 | head -20

This would be on a CentOS platform, though I've enjoyed the same results on Fedora as well.

Oh and for grins, I sometimes want to remove a set of processes, so I simply use a variant on the above that includes a bit of grep -v action, such as:

ps auxww --sort=lstart | sort -r -k3,4 | grep -v "sbin/httpd" | head -20

Solution 4

I can't comment yet, but to answer the question about how to reverse the order of a time sort, just put a minus sign (-) in front of the field.
Example: ps -elf --sort=-start_time

Solution 5

Or try 'ls', as it allows time formats that are easy to sort, and easier to use.

( cd /proc; ls -td --full-time --time-style=+%s [0123456789]*; )

Outputs the date/time in epoch, newest procs at the top.

View more solutions

102,314

Dean Smith

Updated on September 17, 2022

Comments

Dean Smith over 1 year

Is there a way to sort ps output by process start time, so newest are either at the top or bottom ?

On Linux ?

On SysV5 ?

On Mac ?
Dean Smith almost 15 years

I'm afraid neither of those sorts by start time. It does display the start time, but doesn't sort.
Dean Smith almost 15 years

This works exactly as requested, thanks. After more digging I am not sure this is possible on Mac OS without a bit of awk
LHMathies about 12 years

The difference between lstart and start_time caught me out as well -- lstart gives a full timestamp, but cannot be used as a sort key. start_time gives the usual 'time within the last 24 hours, date otherwise' column, and can be used as a sort key. Both give 'STARTED' in the header.
Olivier Dulac about 11 years

time within last hour: if a process was launched yesterday at a time later than today, it will appear after today's process ... can't be used by sort, unless a bit of "awk" changes that
Gauthier over 9 years

@OlivierDulac: not for me. 15/12 15:40 appears before 16/12 15:39, just as 13:39 appears before 15:38.
kellogs over 9 years

--sort of ps does not work for me. Relying on shell sort. +1
Felipe Alvarez over 9 years

lstart did not work for me. start_time did.
Felipe Alvarez over 9 years

start_time worked. lstart did not. RHEL
Suresh Mahawar almost 8 years

ps aux --sort=start_time command works fine
0x89 almost 8 years

OS X 10.11: ps: started: keyword not found. ps -L gives lstart and start.
Phu Nguyen over 7 years

how to I reverse the order?
Paul over 6 years

@PhuNguyen bit late to the party, but maybe someone else has a use for this. You can reverse the order by piping the output through tac.
Stephane almost 5 years

How about keep watching the last 10 processes ?
TechnoTony almost 5 years

@Stephane try this: watch "ps -ef --sort=start_time | grep -v kworker | tail"
Stephane almost 5 years

My take ps-recent() { watch "ps -ef --sort=start_time | tail -n $1"; }
elig almost 5 years

@PhuNguyen use a '-' before the key like --sort=-pid '+' is redundant to the default
elig almost 5 years

this only shows the pids