1

I am checking processes by "p" command and output is like below. 

UID         PID   PPID  C STIME TTY          TIME CMD                                    
myapp    10235  20365 99 Feb15 ?        11-15:01:41 cont AppRating  
myapp    20168  20365 99 01:39 ?        18:29:08 cont AppRating     
myapp    20322      1  0  2017 ?        18:07:14 monitor -p -a                          
myapp    20355  20322  0  2017 ?        12:34:55 agent -n                              
myapp    20780  20322 10  2017 ?        12-02:36:07 bsus -n                            
myapp    40675  20365 99 Feb16 ?        10-10:34:21 cont AppRating  
myapp    60749  20365 99 Feb21 ?        1-22:12:18 cont AppRating    
myapp   143363  20365  4 Feb26 ?        08:04:12 cont TimeOutSession    
myapp   143569  20365  1 Jan31 ?        05:57:05 cont AMn               
myapp   242818  20365 99 Feb21 ?        1-00:00:38 cont AppRating

Now i want to check the processes whose STIME is after day before yesterday.
suppose if today date is 27th feb 2018. then i want to check whether any process started after 26th feb 2018 00:00 AM.
if yes then print not ok infront of that line. like below output.

myapp    20168  20365 99 01:39 ?        18:29:08 cont AppRating --> NOTOK  
myapp   143363  20365  4 Feb26 ?        08:04:12 cont TimeOutSession --> NOTOK

Otherwise print simply "OK" only.

Improve this question

3 Answers 3

Reset to default
1

Your p command seems to produce the same kind of output as ps -Af, it might be an alias.

The STIME in there is in the HH:MM format for processes started today, MonDD for processes started before today, YYYY for processes started last year or before, so to report processes that were started yesterday or today and assuming today is not the first of January, you could just look for entries where the STIME is the MonDD of yesterday or is in the HH:MM format.

Here assuming the GNU implementation of date:

p | awk -v yesterday="$(LC_ALL=C date -d yesterday +%b%d)" '
  NR > 1 {$0 = $0 " --> " ($5 == yesterday || $5 ~ /:/ ? "NOTOK" : "OK")}
  {print}'
Improve this answer
0

The easiest approach that I can think of is choosing the output in seconds from the start.

ps -eo etimes,pid,cmd

This will give a list with the seconds since the start of the process, like this:

ELAPSED   PID CMD
  13802 26157 /just/some/command

The result can be used to extract the data. As I couldn't understand which logic you wanted to apply (something about two days ago), I just output the information and you can adjust the script to your needs. 172800 is 2 * 86400, which are the number of seconds in a day.

#!/bin/bash
ps -eo etimes,pid,cmd | grep -v ^ELAPSED | while read line
do
  ETIME=$(echo ${line} | awk '{ print $1 }')
  if [[ ${ETIME} -gt 172800]]; then
    echo "Old process ${line}"
  else
    echo "Newer process ${line}"
  fi
done
Improve this answer
6
  • when i running this command it's giving me error like below: ERROR: Unknown user-defined format specifier "etimes". Commented Feb 27, 2018 at 10:36
  • Which operation system are you using? I was testing on linux, especially Ubuntu. Commented Feb 27, 2018 at 10:37
  • i am using suse linux. Commented Feb 27, 2018 at 10:41
  • According to this man page, you might try etime. The trouble is that the output will be in the form [[dd-]hh:]mm:ss. So you'll have to re-calculate the output. This will still be possible as only numbers are involved, rather than dates with names of month written out. Commented Feb 27, 2018 at 10:46
  • dear stefan, by this command i am not getting application specific user processes. it's giving the all the processes whether it's related to user or not. Commented Feb 27, 2018 at 11:52
0

Suppose if you want to check Process started 1 day earlier we can follow below steps

capturing_date=$(date +%b%d -d "1 days ago")


ps -eaf |awk -v k="$capturing_date" '$5 == k {print $0"============================>  Not OK"}'

Variable capturing_date ===> Captures the date one day earlier

ps -eaf |awk -v k="$capturing_date" '$5 == k {print $0"============================>  Not OK"}'   =================> it will  check for process which started 1 day earlier by evaluating in column 5
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.