There is a Debian bug report where they have processes that have the wrong
start time. It seems that the btime (boot time) field is sometimes not
updated or set correctly, especially for some sort of virtualisation.
For my systems, it looks like a harmless change. However I want people to
check for themselves. Dan has provided a test script below.
Effectively, btime = now - uptime and it should be for most devices; except
where it is not. He gets correct answers using uptime.
- Craig
---------- Forwarded message ---------
From: 積丹尼 Dan Jacobson <jidanni@xxxxxxxxxxx>
Date: Sun, Nov 6, 2016 at 10:21 AM
Subject: Bug#842879: use uptime, not btime, else wrong start times on some
systems
To: <842879@xxxxxxxxxxxxxxx>, <csmall@xxxxxxxxxx>
severity 842879 normal
retitle 842879 use uptime, not btime, else wrong start times on some systems
thanks
Craig, it turns out ps is using the wrong file in the first place!
If it used /proc/uptime it would surely never have this problem on any
system.
$ perl /tmp/misTime|head
(init):
b Tue Aug 9 06:05:54 2016
u Sun Oct 16 22:34:14 2016
(pickup):
b Mon Aug 29 12:39:39 2016
u Sun Nov 6 05:08:00 2016
(apache2-ps11007):
b Sun Aug 28 23:13:39 2016
u Sat Nov 5 15:42:00 2016
$ uptime
07:15:40 up 20 days, 8:41, 1 user, load average: 0.00, 0.00, 0.00
$ cat /tmp/misTime
#!/usr/bin/perl
# Author : Dan Jacobson -- http://jidanni.org/
# Created On : Sat Nov 5 18:11:17 2016
# Last Modified On: Sun Nov 6 05:52:38 2016
# Update Count : 71
# Reproduce wrong time effect
use strict;
use warnings FATAL => q(all);
open( my $fh, "<", "/proc/stat" ) or die;
my $btime;
while (<$fh>) {
if (/^btime/) { /\d+/; $btime = $&; last; }
}
close $fh;
open( my $fh1, "<", "/proc/uptime" ) or die;
my $uptime;
while (<$fh1>) {
/[\d.]+/ || die;
$uptime = $&;
}
close $fh1;
@ARGV = glob "/proc/[0-9]*/stat";
while (<>) {
my @F = split;
printf "%s:\n\tb %s\n\tu %s\n", $F[1],
scalar localtime( $F[21] / 100 + $btime ),
scalar localtime( $F[21] / 100 + time - $uptime );
}
#I'll also tell the libproc-processtable-perl guys.
--
Craig Small (@smallsees) http://dropbear.xyz/ csmall at : enc.com.au
Debian GNU/Linux http://www.debian.org/ csmall at : debian.org
GPG fingerprint: 5D2F B320 B825 D939 04D2 0519 3938 F96B DF50 FEA5
