Return to Answer

(
  export TZ=UTC0 LC_ALL=C
  ps -A -o lstart= -o pid= -o args= |
    perl -MDate::Manip -lpe '
      s/^(\s*\S+){5}/UnixDate(ParseDate($&), "%Y-%m-%dT%T+00:00")/e' |
    sort
)

(
  export TZ=UTC0 LC_ALL=C
  unset -v IFS
  ps -A -o lstart= -o pid= -o args= |
    while read -r a b c d e rest; do
      printf '%(%FT%T+00:00)T %s\n' "$a $b $c $d $e" "$rest"
    done
)

(export TZ=UTC0 LC_ALL=C
  ps -A -o lstart= -o pid= -o args= |
    perl -MDate::Manip -lpe '
      s/^(\s*\S+){5}/UnixDate(ParseDate($&), "%Y-%m-%dT%T+00:00")/e' |
    sort
)

(export TZ=UTC0 LC_ALL=C
  unset -v IFS
  ps -A -o lstart= -o pid= -o args= |
    while read -r a b c d e rest; do
      printf '%(%FT%T+00:00)T %s\n' "$a $b $c $d $e" "$rest"
    done
)

Or with zsh and GNU date:

(export LC_ALL=C TZ=UTC0
  (){
    paste -d '\0' <(cut -c1-24 < $1 | date -f- --iso-8601=s) \
                  <(cut -c25-  < $1) | sort
  } =(ps -A -o lstart= -o pid= -o args=)
)

Or with bash (or zsh) on Linux only and with GNU date:

(export LC_ALL=C TZ=UTC0
  {
    paste -d '\0' <(cut -c1-24 | date -f- --iso-8601=s) \
                  <(cut -c25- < /dev/stdin) | sort
  } <<< "$(ps -A -o lstart= -o pid= -o args=)"
)
  
    

Here, you could force the times to be UTC and use perl's Date::Manip to parse the date in a way that understands different natural formats:

Also beware that the process start time is not necessarily the same as the last time that process executed a command. In other words, it doesn't necessarily correspond to the time the command (args field, the standard equivalent of cmd) was started.

Here, you could force the times to be UTC and use perl's Date::Manip module to parse the date in a way that understands different natural formats:

Also beware that the process start time is not necessarily the same as the last time that process executed a command as processes can an generally do run more than one command in their lifetime (those that don't are generally those that never execute a command). In other words, it doesn't necessarily correspond to the time the command (args field, the standard equivalent of cmd) was started.

$ sh -c 'sleep 4; exec sleep 123' & sleep 234 & sleep 5
[1] 9380
[2] 9381
$ (export TZ=UTC0 LC_ALL=C; ps -o lstart,pid,args | perl -MDate::Manip -lpe 's/^(\s*\S+){5}/UnixDate(ParseDate($&), "%Y-%m-%dT%T+00:00")/e')

2017-10-30T17:21:06+00:00  3071 zsh
2017-11-01T15:47:48+00:00  9380 sleep 123
2017-11-01T15:47:48+00:00  9381 sleep 234

See how sleep 123 is seen as having been started at the same time as sleep 234 even though it was started 4 seconds later. That's because that 9388 process was initially running sh (and waiting 4 seconds for sleep 4) before it executed sleep 123 (and before that, it was running zsh code as it was forked by my interactive shell, so at different points in time, for that process, you would have seen in the ps output: zsh, then sh, then sleep).