Search code examples
c++linuxprocesstimestampredhat

API to retrieve process creation time (Linux)

I am looking for an API that a process can use to figure out its own creation timestamp. With 'creation timestamp' I mean the point in time where the process was "born", i.e. the birth timestamp.

The specifics of my situation:

  • The program I need this for is a C++ library; and
  • is compiled with gcc 7.3.1; and
  • runs on Linux, Red Hat Enterprise Linux Server release 6.8 (Santiago) to be precise.
  • I need to achieve at least milliseconds precision.
  • I don't have access/control over what happens at program startup (because I am working on a library, consumed by various applications)

I've been searching for a while now and haven't found something that solves my problem. The two most promising candidates are listed below:

Look up starttime in /proc/PID/stat

It seems the /proc/PID/stat file provides a field called starttime (entry 22). The doc for reference: https://man7.org/linux/man-pages/man5/proc.5.html

This way I'd still need to:

  • find the machine boot time;
  • convert the starttime from jiffies to microseconds;
  • do the math to "add it" to the boot time.

That's not impossible, but I was hoping there's an easier path to the information I need. As of now I don't know how to get the system boot time (with at least microsecond precision). I am aware of start time of a process on linux - but this calculation uses the btime which has only second precision, so not precise enough to meet the requirements :|

The stat function

According to https://man7.org/linux/man-pages/man2/stat.2.html the stat function can provide me various file-related timestamps, most notably:

struct timespec st_atim;  /* Time of last access */
struct timespec st_mtim;  /* Time of last modification */
struct timespec st_ctim;  /* Time of last status change */

However, as explained in https://man7.org/linux/man-pages/man7/inode.7.html, it seems none of those are actually guaranteed to be equal to the birth timestamp, because all these timestamps can get updated by certain operations (reads/writes etc)

It seems what I want is the File creation (birth) timestamp (btime). The linux man pages have the following to say:

File creation (birth) timestamp (btime)
      (not returned in the stat structure); statx.stx_btime

      The file's creation timestamp.  This is set on file creation
      and not changed subsequently.

      The btime timestamp was not historically present on UNIX
      systems and is not currently supported by most Linux
      filesystems.

So ... I am unsure what's the best way to obtain the process creation time. Thank you for reading this far, you are awesome!

Solution

  • POSIX stat doesn’t define this field, but you can get it from statx.

    This was added at the start of 2019, so you need fairly new kernel and glibc versions to take advantage of it.