Note that lstart is not one of the standard Unix ps columns.
Not all systems have one, and the output varies between implementations and potentially between locales.
For instance, on FreeBSD or with the ps from procps-ng (as typically found on non-embedded Linux-based systems) and the C locale, you'll get:
Wed Nov 1 12:36:15 2017
On macOS:
Wed 1 Nov 12:36:15 2017
Also, since, it doesn't give you the GMT offset, the output is ambiguous in timezones that implement DST (where there's one hour during the year where the same dates occur twice) and do not always sort chronologically.
Here, you could force the times to be UTC and use perl's Date::Manip to parse the date in a way that understands different natural formats:
(
export TZ=UTC0 LC_ALL=C
ps -eo lstart,pid,args |
perl -MDate::Manip -lpe '
s/^(\s*\S+){5}/UnixDate(ParseDate($&), "%Y-%m-%dT%T+00:00")/e' |
sort
)
Or with ksh93 which also recognises those date formats:
(
export TZ=UTC0 LC_ALL=C
unset -v IFS
ps -eo lstart,pid,args |
while read a b c d e rest; do
printf '%(%FT%T+00:00)T %s\n' "$a $b $c $d $e" "$rest"
done
)
(beware it strips trailing blanks from each line)
Also beware that the process start time is not necessarily the same as the last time that process executed a command. In other words, it doesn't necessarily correspond to the time the command (args field, the standard equivalent of cmd) was started.