I am trying to filter some output with an "if" in an "awk" command but I cant seem to find the right syntax for time.


Command:
ps -ef -o comm -o time

Output:
/usr/../../ddterm 0:40
/bin/csh 11:30
/user/../../graph 30:00
....... ......

I want to pull the processes that have been running for more than 12 hours.

ps -ef -o comm -o time | awk '{if ($2 -gt 12) print}'

Any help would be greatly appreciated.

And yes, I did utilize the search function.

You didn't say what shell, but here's how I'd do it in ksh:

ps -ef -o comm= -o time= | awk -F: '$2 > 12 {print}'

Thanks for such a quick reply.

Any shell is fine by me.

Heres the problem though, that will filter by the minutes.

So it will not display:

a process with the time 18:16:(10 <----not greater than 12)

-o time option displays time as [[dd-]hh::]mm:ss

So..a Process running for 13 days-10 hours looks like this:
13-10:57:33

So I need to evaluate it as a whole, or the hour column along with the day column.

-----
part of the post was displaying as a smily...

Oops. Yeah, I was running PS on our system and nothing came up as running over 24 hours, so I forgot a 1- or 2-, etc will show up...

Let's try this convoluted looking line instead:

ps -ef -o comm= -o time= | awk '/[0-9]-[0-9][0-9]:[0-9][0-9]:[0-9][0-9]/ || substr($2,1,2) > 12 {print $0}'

This way, if either the process is running a day or more (and something like 1- or 2- is present) or the hour section of the running time is greater than 12, then the line prints.

I took the first part of the awk command and used that. Changing the 12 hour criteria to anything over a day.

But I'd like to figure this out, I've been trying for the last few hours, but my scripting, programming is not up to snuff.

taking the input of:

command1 38:41
command2 0:07
command3 3-11:37:51
command4 1:45
command5 1-04:00:50


the:

substr($2,1,2) > 12

will print commands 1,3,4

That substr will evaluate the first two digits is comes across totally disregarding the special characters ":" and "-"

so command4 1:45 = true because 14 > 12
command5 1-04:00:50 = false because 1-0 < 12 though this is more than 12 hours, which I want.

Do you think it would be possible to format this with the awk version of split?

I made that script on the assumption that if something's been running 1 minute and 45 seconds, it'd show up as 00:01:45 (as it does on my system) and not 1:45 (as you have it).

It gets even more convoluted... this displays any entry that shows a day (blue part) OR shows an hour greater than or equal to 12 (red part).

ps -ef -o comm= -o time= | awk '/[1-9]-[0-9][0-9]:[0-9][0-9]:[0-9][0-9]/ || /[1-2][2-9]:[0-9][0-9]:[0-9][0-9]/ || /[2][0-9]:[0-9][0-9]:[0-9][0-9]/ {print $0}'