listing processes older than n days


 
Thread Tools Search this Thread
Operating Systems HP-UX listing processes older than n days
# 1  
Old 02-08-2012
listing processes older than n days

Hello; trying to find processes older than n days, mostly user shells Tried the following code on 11.31 box: in this case older than 5 days

Code:
UNIX95= ps -ef -o user,pid,ppid,cpu,etime,stime | grep "-" | awk '{print $2}' | xargs ps -ef|grep -v '?' |\
awk '$5 !~ "[0-9][0-9]"' | awk '($5 ~ "$(date "+%b")") && ($6 <= "$(echo $(date "+%e") - 5 | bc)")'

but is erroring out with:

Code:
 syntax error The source line is 1.
 The error context is
                ($5 ~ "$(date >>>  "+% <<< b")") && ($6 <= "$(echo $(date "+%e") - 5 | bc)")
        awk: There is an extra ) character.
 awk: Quitting
 The source line is 1.

Anyone has other/better ideas ??

Thank you
# 2  
Old 02-08-2012
Code:
ps -ef  | perl -MDate::Calc -e 'while(<>){print "$1\t:\t$2\n" if ((/^\s+\w+\s+(\d+)\s+\d+\s+\d+\s+(\w{3}\s+\d+|20\d+|\d{2}:\d{2}:\d{2})/)&&(more_recent($2,3)))}'

writing the more_recent routine is left as a rather complex exercise Smilie The regex above will capture the following time stamp styles in $2
16:45:00
Feb 08
2011
Your more_recent routine would have to deal with that (The first is obviously today's the last obviously later so only the middle style requires the use of the Date::Calc module.
# 3  
Old 02-08-2012
Quote:
Originally Posted by Skrynesaver
Code:
ps -ef  | perl -MDate::Calc -e 'while(<>){print "$1\t:\t$2\n" if ((/^\s+\w+\s+(\d+)\s+\d+\s+\d+\s+(\w{3}\s+\d+|20\d+|\d{2}:\d{2}:\d{2})/)&&(more_recent($2,3)))}'

writing the more_recent routine is left as a rather complex exercise Smilie The regex above will capture the following time stamp styles in $2
16:45:00
Feb 08
2011
Your more_recent routine would have to deal with that (The first is obviously today's the last obviously later so only the middle style requires the use of the Date::Calc module.
Thank you .. just starting to learn Perl so not sure what you are refering to ..
# 4  
Old 02-08-2012
Another approach (skeleton). Start with "UNIX95= ps -af" to eliminate most of the system processes, then eliminate anything dated today and positively select lines containing a hyphen (which comes from changed format of "etime" greater than one day).
One side effect is that this pick up "defunct" processes (which display in the old "ps" as uid -3), but they might be interesting anyway.
Avoided outputting the "args" option because it could contain hyphens.

Code:
MMMDD=`date +'%b %e'`
UNIX95= ps -af -o user,pid,ppid,cpu,etime,stime| \
                grep -v "PID"| grep -v "${MMMDD}" | grep "\-"


If you need to output the process line in new "ps" format then we can extend the pipeline to pick up the PID ($2) and feed it to "ps -fp<pid>", eliminate "defunct", and then feed the list to a less-complicated "awk" because all the dates will be in the same format. No need to do "ps -ef" for every individual process.

Afterthought: The UNIX95 "ps" etime field contains the number of days old. This might be simple.

Last edited by methyl; 02-08-2012 at 03:27 PM..
# 5  
Old 02-08-2012
Quote:
Originally Posted by methyl
Another approach (skeleton). Start with "UNIX95= ps -af" to eliminate most of the system processes, then eliminate anything dated today and positively select lines containing a hyphen (which comes from changed format of "etime" greater than one day).
One side effect is that this pick up "defunct" processes (which display in the old "ps" as uid -3), but they might be interesting anyway.
Avoided outputting the "args" option because it could contain hyphens.

Code:
MMMDD=`date +'%b %e'`
UNIX95= ps -af -o user,pid,ppid,cpu,etime,stime| \
                grep -v "PID"| grep -v "${MMMDD}" | grep "\-"

If you need to output the process line in new "ps" format then we can extend the pipeline to pick up the PID ($2) and feed it to "ps -fp<pid>", eliminate "defunct", and then feed the list to a less-complicated "awk" because all the dates will be in the same format. No need to do "ps -ef" for every individual process.

Afterthought: The UNIX95 "ps" etime field contains the number of days old. This might be simple.
Thank you very much !!

Finally got it working.. added following filters for user procs older 5 days in this case.

Code:
UNIX95= ps -af -o user,pid,ppid,cpu,etime,stime| grep "\-" | awk '$5 >= "5"' |\
awk '{print "ps -fp "$2}'|sh | awk '( NR ==1 ) || ( NR > 1 && $1 !~ "UID")'

# 6  
Old 02-08-2012
@delphys
I'm no awk expert but this has inspired me to learn. If awk can take the leading numeric character(s) of a complex alphanumeric string (like the format of "etime" from a Berkeley "ps") into a numeric comparison awk '$5 >= "5"' that is really useful.
Personally I'd would have had to extract the leading numbers (i.e. the number of idle days) and used a Shell integer comparison.
# 7  
Old 02-08-2012
Quote:
Originally Posted by delphys
Thank you very much !!

Finally got it working.. added following filters for user procs older 5 days in this case.

Code:
UNIX95= ps -af -o user,pid,ppid,cpu,etime,stime| grep "\-" | awk '$5 >= "5"' |\
awk '{print "ps -fp "$2}'|sh | awk '( NR ==1 ) || ( NR > 1 && $1 !~ "UID")'

I would have coded the check for greater than 5 days differently. At least with the version of awk I've got installed in various places, your code doesn't work. Here is the output using your ps command from one of my boxes:

Code:
ps af -o user,pid,ppid,cpu,etime,stime 
USER       PID  PPID CPU     ELAPSED STIME
scooter  20422 20420   -  9-21:01:26 Jan29
scooter  11297 11295   -  1-19:58:34 Feb06
scooter   8004  8002   -  1-21:44:42 Feb06
scooter   8028  8004   -  1-21:44:35 Feb06
scooter   6832  6830   - 12-19:32:12 Jan26
scooter  15635  6832   -       00:00 18:24
scooter   4507  4505   - 12-20:29:18 Jan26
scooter   4420  4406   - 12-20:30:07 Jan26
scooter   5802  4245   -  2-18:54:15 Feb05
root      4061  4058   - 12-20:31:53 Jan26
scooter  13648     1   -  1-18:39:33 Feb06
scooter  19532 13648   -    18:18:29 00:05
scooter  19533 13648   -    18:18:29 00:05
scooter   4468     1   - 12-20:29:49 Jan26
scooter   4469  4468   - 12-20:29:49 Jan26
scooter   4467     1   - 12-20:29:50 Jan26
scooter   4441     1   - 12-20:29:50 Jan26
scooter   4452  4441   - 12-20:29:50 Jan26
scooter   4453  4441   - 12-20:29:50 Jan26
scooter   4440     1   - 12-20:29:50 Jan26
scooter   4439     1   - 12-20:29:50 Jan26
root      4240     1   - 12-20:31:50 Jan26
root      4233     1   - 12-20:31:50 Jan26
root      4229     1   - 12-20:31:50 Jan26
root      4227     1   - 12-20:31:50 Jan26
root      4225     1   - 12-20:31:50 Jan26

When I pipe that through your awk ($5 > "5") the output is this:
Code:
USER       PID  PPID CPU     ELAPSED STIME
scooter  20422 20420   -  9-21:03:52 Jan29

which as far as I can tell is wrong. It should have listed all of the processes that are shown as being 12 days old in addition to the one that it did list.

The problem is that you are doing string comparison, instead of doing numeric comparison and a string which begins with a '1' is less than a string that begins with a '5'.

I make a habit of always 'casting' fields to force them to be numeric before doing any kind of numeric comparison with them. I've been bitten countless times by forgetting this. To fix the problem, change your awk:

Code:
awk ' $5+0 > 5'

Notice that there are no quotes round the 5, and that +0 causes the fifth field to be converted to integer before doing the comparison. A string like
12-20:31:50 becomes an integer 12 when 0 is added to it, and the comparison yields the expected result. With the changes:

Code:
ps af -o user,pid,ppid,cpu,etime,stime| grep -- "[0-9]-[0-9]"|awk '$5+0 > 5' 
scooter  20422 20420   -  9-21:11:53 Jan29
scooter   6832  6830   - 12-19:42:39 Jan26
scooter   4507  4505   - 12-20:39:45 Jan26
scooter   4420  4406   - 12-20:40:34 Jan26
root      4061  4058   - 12-20:42:20 Jan26
scooter   4468     1   - 12-20:40:16 Jan26
scooter   4469  4468   - 12-20:40:16 Jan26
scooter   4467     1   - 12-20:40:17 Jan26
scooter   4441     1   - 12-20:40:17 Jan26
scooter   4452  4441   - 12-20:40:17 Jan26
scooter   4453  4441   - 12-20:40:17 Jan26
scooter   4440     1   - 12-20:40:17 Jan26
scooter   4439     1   - 12-20:40:17 Jan26
root      4240     1   - 12-20:42:17 Jan26
root      4233     1   - 12-20:42:17 Jan26
root      4229     1   - 12-20:42:17 Jan26
root      4227     1   - 12-20:42:17 Jan26
root      4225     1   - 12-20:42:17 Jan26

You should also notice the change to the grep that avoids picking up a record for a process active less than 24 hours (it matched the dash in the cpu column, and the change forces it to match a dash only between two numbers as would appear in the date column.) You can also eliminate the grep completely:

Code:
ps af -o user,pid,ppid,cpu,etime,stime| awk ' $5 ~/[0-9]-[0-9]/ && $5+0 > 5'


Last edited by agama; 02-08-2012 at 08:49 PM.. Reason: clarification, addition of elimination of grep
These 2 Users Gave Thanks to agama For This Post:
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Listing files older than 30 days

Hi, Could someone help me that what the problem is in this code? #!/bin/sh FOLDER=/abc/datasource/checkstatus TIMESTAMP=$(date +%s) for filename in $(find $FOLDER -maxdepth 1 -type f -name "CHECK_STATUS*"); do f1=$($filename -Eo "{4}+") f2=$(date -d "$f1" +%s) if... (11 Replies)
Discussion started by: Home
11 Replies

2. Shell Programming and Scripting

Remove files older than 2 days.

Hi All, I am new to the scripting and using solaris 10 OS. Please suggest me from the below script which modifications need to be done to delete the files more that 2days older. Current script is deleting existing file. # Remove old explorer runs if needed DIR=`dirname ${EXP_TARGET}` if ... (2 Replies)
Discussion started by: Navkreddy
2 Replies

3. UNIX for Dummies Questions & Answers

Files older than 50 days

Hi All, OS :- HP-UX wm5qa B.11.23 U ia64 1119805695 unlimited-user license I need to search files older than 50 days. I've used following command in order to search desired files, I also discoverd, it's showing today's files as well. Do you have any clue with this ? wmqa1> find .... (4 Replies)
Discussion started by: alok.behria
4 Replies

4. Shell Programming and Scripting

Listing processes that are a day older

Hi All, I am trying to automate some stuff to make my 'to-do-things' easier. I am in need for help regarding this. I have an output root 17187 3465 0 23:00:00 ? 0:01 Process1 root 4975 4974 0 May 12 ? 0:00 Process2 root 4042 16713 0 Jan 30 pts/22 0:00... (4 Replies)
Discussion started by: reddybs
4 Replies

5. Shell Programming and Scripting

Delete folders older than 30 days

Dear all, i use incremental backup my data with .zip to my hard drive. what i need is i don't want the old .zip file older than 30 days. how to write a shell script automatically remove my external hard disc zip backup folders older than 30 days? Regards, (2 Replies)
Discussion started by: joneggk
2 Replies

6. Shell Programming and Scripting

Need to kill processes that are older than 3 days

Hi, I need a .ksh script that lists all the process that are currently running and older than 3 days. once the process list is available i need to mail the list and then kill those processes. Quick response is highly appreciated :b: Thanks in Advance!!! Sri (3 Replies)
Discussion started by: Sriranga
3 Replies

7. Solaris

Delete files older than 30 days

Hi all, I want to delete log files with extension .log which are older than 30 days. How to delete those files? Operating system -- Sun solaris 10 Your input is highly appreciated. Thanks in advance. Regards, Williams (2 Replies)
Discussion started by: William1482
2 Replies

8. UNIX for Dummies Questions & Answers

Find files older than 5 days and remove tem after listing

need help with this ... Find files older than 5 days and remove tem after listing list "test" file older than 5 days and then remove them (1 Reply)
Discussion started by: ypatel6871
1 Replies

9. UNIX for Dummies Questions & Answers

How can I delete files older than 7 days?

I will like to write a script that delete all files that are older than 7 days in a directory and it's subdirectories. Can any one help me out witht the magic command or script? Thanks in advance, Odogboly98:confused: (3 Replies)
Discussion started by: odogbolu98
3 Replies

10. Shell Programming and Scripting

Listing files older than 2 months

A script or command to list files older than 2 months in a specified directory and remove it. (3 Replies)
Discussion started by: pbekal
3 Replies
Login or Register to Ask a Question

Featured Tech Videos