<p>I have a problem with some zombie-like processes on a certain server that need to be killed every now and then. How can I best identify the ones that have run for longer than an hour or so?</p>

[{'answer_id': 6141, 'author': 'abyx', 'author_id': 573, 'author_profile': 'https://Stackoverflow.com/users/573', 'pm_score': 0, 'selected': False, 'text': "<p>Using ps is the right way. I've already done something similar before but don't have the source handy.\nGenerally - ps has an option to tell it which fields to show and by which to sort. You can sort the output by running time, grep the process you want and then kill it.</p>\n\n<p>HTH</p>\n"}, {'answer_id': 6145, 'author': 'Mark Harrison', 'author_id': 116, 'author_profile': 'https://Stackoverflow.com/users/116', 'pm_score': 5, 'selected': False, 'text': "<p>For anything older than one day,</p>\n\n<pre><code>ps aux\n</code></pre>\n\n<p>will give you the answer, but it drops down to day-precision which might not be as useful.</p>\n\n<pre><code>USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND\nroot         1  0.0  0.0   7200   308 ?        Ss   Jun22   0:02 init [5]\nroot         2  0.0  0.0      0     0 ?        S    Jun22   0:02 [migration/0]\nroot         3  0.0  0.0      0     0 ?        SN   Jun22   0:18 [ksoftirqd/0]\nroot         4  0.0  0.0      0     0 ?        S    Jun22   0:00 [watchdog/0]\n</code></pre>\n\n<p>If you're on linux or another system with the /proc filesystem,  In this example, you can only see that process 1 has been running since June 22, but no indication of the time it was started.</p>\n\n<pre><code>stat /proc/&lt;pid&gt;\n</code></pre>\n\n<p>will give you a more precise answer.  For example, here's an exact timestamp for process 1, which ps shows only as Jun22:</p>\n\n<pre><code>ohm ~$ stat /proc/1\n  File: `/proc/1'\n  Size: 0               Blocks: 0          IO Block: 4096   directory\nDevice: 3h/3d   Inode: 65538       Links: 5\nAccess: (0555/dr-xr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)\nAccess: 2008-06-22 15:37:44.347627750 -0700\nModify: 2008-06-22 15:37:44.347627750 -0700\nChange: 2008-06-22 15:37:44.347627750 -0700\n</code></pre>\n"}, {'answer_id': 6150, 'author': 'yukondude', 'author_id': 726, 'author_profile': 'https://Stackoverflow.com/users/726', 'pm_score': 5, 'selected': False, 'text': "<p>Found an answer that works for me:</p>\n\n<p><strong>warning: this will find <em>and kill</em> long running processes</strong></p>\n\n<pre><code>ps -eo uid,pid,etime | egrep '^ *user-id' | egrep ' ([0-9]+-)?([0-9]{2}:?){3}' | awk '{print $2}' | xargs -I{} kill {}\n</code></pre>\n\n<p>(Where <em>user-id</em> is a specific user's ID with long-running processes.)</p>\n\n<p>The second regular expression matches the a time that has an optional days figure, followed by an hour, minute, and second component, and so is at least one hour in length.</p>\n"}, {'answer_id': 6167, 'author': 'ggasp', 'author_id': 527, 'author_profile': 'https://Stackoverflow.com/users/527', 'pm_score': 3, 'selected': False, 'text': '<p>In this way you can obtain the list of the ten oldest processes: </p>\n\n<pre>ps -elf | sort -r -k12 | head -n 10</pre>\n'}, {'answer_id': 1616779, 'author': 'Maniraj Patri', 'author_id': 195723, 'author_profile': 'https://Stackoverflow.com/users/195723', 'pm_score': 2, 'selected': False, 'text': '<p>do a <code>ps -aef</code>. this will show you the time at which the process started. Then using the <code>date</code> command find the current time. Calculate the difference between the two to find the age of the process.</p>\n'}, {'answer_id': 3474710, 'author': 'Peter V. Mørch', 'author_id': 345716, 'author_profile': 'https://Stackoverflow.com/users/345716', 'pm_score': 3, 'selected': False, 'text': '<p>Perl\'s Proc::ProcessTable will do the trick:\n<a href="http://search.cpan.org/dist/Proc-ProcessTable/" rel="noreferrer">http://search.cpan.org/dist/Proc-ProcessTable/</a></p>\n\n<p>You can install it in debian or ubuntu with <code>sudo apt-get install libproc-processtable-perl</code></p>\n\n<p>Here is a one-liner:</p>\n\n<pre><code>perl -MProc::ProcessTable -Mstrict -w -e \'my $anHourAgo = time-60*60; my $t = new Proc::ProcessTable;foreach my $p ( @{$t-&gt;table} ) { if ($p-&gt;start() &lt; $anHourAgo) { print $p-&gt;pid, "\\n" } }\'\n</code></pre>\n\n<p>Or, more formatted, put this in a file called process.pl:</p>\n\n<pre><code>#!/usr/bin/perl -w\nuse strict;\nuse Proc::ProcessTable;\nmy $anHourAgo = time-60*60;\nmy $t = new Proc::ProcessTable;\nforeach my $p ( @{$t-&gt;table} ) {\n    if ($p-&gt;start() &lt; $anHourAgo) {\n        print $p-&gt;pid, "\\n";\n    }\n}\n</code></pre>\n\n<p>then run <code>perl process.pl</code></p>\n\n<p>This gives you more versatility and 1-second-resolution on start time.</p>\n'}, {'answer_id': 7020431, 'author': 'Rodney Amato', 'author_id': 4342, 'author_profile': 'https://Stackoverflow.com/users/4342', 'pm_score': 1, 'selected': False, 'text': "<p>I did something similar to the accepted answer but slightly differently since I want to match based on process name and based on the bad process running for more than 100 seconds </p>\n\n<pre><code>kill $(ps -o pid,bsdtime -p $(pgrep bad_process) | awk '{ if ($RN &gt; 1 &amp;&amp; $2 &gt; 100) { print $1; }}')\n</code></pre>\n"}, {'answer_id': 9316199, 'author': 'mob', 'author_id': 168657, 'author_profile': 'https://Stackoverflow.com/users/168657', 'pm_score': 1, 'selected': False, 'text': "<p><code>stat -t /proc/&lt;pid&gt; | awk '{print $14}'</code></p>\n\n<p>to get the start time of the process in seconds since the epoch. Compare with current time (<code>date +%s</code>) to get the current age of the process.</p>\n"}, {'answer_id': 9973593, 'author': 'David Jeske', 'author_id': 519568, 'author_profile': 'https://Stackoverflow.com/users/519568', 'pm_score': 0, 'selected': False, 'text': "<p>In case anyone needs this in C, you can use readproc.h and libproc:</p>\n\n<pre><code>#include &lt;proc/readproc.h&gt;\n#include &lt;proc/sysinfo.h&gt;\n\nfloat\npid_age(pid_t pid)\n{\n        proc_t proc_info;\n        int seconds_since_boot = uptime(0,0);\n        if (!get_proc_stats(pid, &amp;proc_info)) {\n                return 0.0;\n        }\n\n        // readproc.h comment lies about what proc_t.start_time is. It's\n        // actually expressed in Hertz ticks since boot\n\n        int  seconds_since_1970 = time(NULL);\n        int time_of_boot = seconds_since_1970 - seconds_since_boot;\n        long  t = seconds_since_boot - (unsigned long)(proc_info.start_time / Hertz);\n\n        int delta = t;\n        float days = ((float) delta / (float)(60*60*24));\n        return days;\n}\n</code></pre>\n"}, {'answer_id': 10525736, 'author': 'Jodie C', 'author_id': 812270, 'author_profile': 'https://Stackoverflow.com/users/812270', 'pm_score': 6, 'selected': True, 'text': '<p>If they just need to be killed:</p>\n\n<pre><code>if [[ "$(uname)" = "Linux" ]];then killall --older-than 1h someprocessname;fi\n</code></pre>\n\n<p>If you want to see what it\'s matching</p>\n\n<pre><code>if [[ "$(uname)" = "Linux" ]];then killall -i --older-than 1h someprocessname;fi\n</code></pre>\n\n<p>The <code>-i</code> flag will prompt you with yes/no for each process match. </p>\n'}, {'answer_id': 11042931, 'author': 'Rafael S. Calsaverini', 'author_id': 114388, 'author_profile': 'https://Stackoverflow.com/users/114388', 'pm_score': 2, 'selected': False, 'text': "<p>You can use <code>bc</code> to join the two commands in mob's answer and get how many seconds ellapsed since the process started: </p>\n\n<pre><code>echo `date +%s` - `stat -t /proc/&lt;pid&gt; | awk '{print $14}'` | bc\n</code></pre>\n\n<p>edit:</p>\n\n<p>Out of boredom while waiting for long processes to run, this is what came out after a few minutes fiddling:</p>\n\n<pre><code>#file: sincetime\n#!/bin/bash\ninit=`stat -t /proc/$1 | awk '{print $14}'`\ncurr=`date +%s`\nseconds=`echo $curr - $init| bc`\nname=`cat /proc/$1/cmdline`\necho $name $seconds\n</code></pre>\n\n<p>If you put this on your path and call it like this:\n   sincetime  </p>\n\n<p>it will print the process cmdline and seconds since started. You can also put this in your path:</p>\n\n<pre><code>#file: greptime\n#!/bin/bash\npidlist=`ps ax | grep -i -E $1 | grep -v grep | awk '{print $1}' | grep -v PID | xargs echo`\nfor pid in $pidlist; do\n    sincetime $pid\ndone\n</code></pre>\n\n<p>And than if you run:</p>\n\n<pre><code>greptime &lt;pattern&gt;\n</code></pre>\n\n<p>where patterns is a string or extended regular expression, it will print out all processes matching this pattern and the seconds since they started. :)</p>\n"}, {'answer_id': 16547667, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 3, 'selected': False, 'text': '<p>Jodie C and others have pointed out that <code>killall -i</code> can be used, which is fine if you want to use the process name to kill.  But if you want to kill by the same parameters as <code>pgrep -f</code>, you need to use something like the following, using pure bash and the <code>/proc</code> filesystem.</p>\n\n<pre><code>#!/bin/sh                                                                                                                                               \n\nmax_age=120 # (seconds)                                                                                                                                 \nnaughty="$(pgrep -f offlineimap)"                                                                                                                       \nif [[ -n "$naughty" ]]; then # naughty is running                                                                                                       \n  age_in_seconds=$(echo "$(date +%s) - $(stat -c %X /proc/$naughty)" | bc)                                                                              \n  if [[ "$age_in_seconds" -ge "$max_age" ]]; then # naughty is too old!                                                                                 \n    kill -s 9 "$naughty"                                                                                                                                \n  fi                                                                                                                                                    \nfi     \n</code></pre>\n\n<p>This lets you find and kill processes older than <code>max_age</code> seconds using the <strong>full process name</strong>; i.e., the process named <code>/usr/bin/python2 offlineimap</code> can be killed by reference to "offlineimap", whereas the <code>killall</code> solutions presented here will only work on the string "python2".</p>\n'}, {'answer_id': 24594339, 'author': 'user3743785', 'author_id': 3743785, 'author_profile': 'https://Stackoverflow.com/users/3743785', 'pm_score': 0, 'selected': False, 'text': '<p>Came across somewhere..thought it is simple and useful</p>\n\n<p>You can use the command in crontab directly ,</p>\n\n<pre><code>* * * * * ps -lf | grep "user" |  perl -ane \'($h,$m,$s) = split /:/,$F\n+[13]; kill 9, $F[3] if ($h &gt; 1);\'\n</code></pre>\n\n<p>or, we can write it as shell script ,</p>\n\n<pre><code>#!/bin/sh\n# longprockill.sh\nps -lf | grep "user" |  perl -ane \'($h,$m,$s) = split /:/,$F[13]; kill\n+ 9, $F[3] if ($h &gt; 1);\'\n</code></pre>\n\n<p>And call it crontab like so,</p>\n\n<pre><code>* * * * * longprockill.sh\n</code></pre>\n'}, {'answer_id': 52023199, 'author': 'Phil Hudson', 'author_id': 6375702, 'author_profile': 'https://Stackoverflow.com/users/6375702', 'pm_score': 0, 'selected': False, 'text': '<p>My version of <code>sincetime</code> above by @Rafael S. Calsaverini :</p>\n\n<pre><code>#!/bin/bash\nps --no-headers -o etimes,args "$1"\n</code></pre>\n\n<p>This reverses the output fields: elapsed time first, full command including arguments second. This is preferred because the full command may contain spaces.</p>\n'}]
['https://Stackoverflow.com/questions/6134', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/726/']