Get process creation date-time in OSX with C / C++ - c++

Question

Given a process id, what is the best way to find the process's creation date-time using C/C++ ?

Answer 1

I'd suggest looking at the top and ps source code (in particular, libtop.c).
I think the following call should be what you need:
int proc_pidbsdinfo(proc_t p, struct proc_bsdinfo *pbsd, int zombie);
From <sys/proc_info.h>:
struct proc_bsdinfo {
...
struct timeval pbi_start;
...
}
Unfortunately there is no public interface for process inspection so the calls are not only version-dependant but also likely to change in future releases.

Answer 2

Here is a simple utility demonstrating how to do this:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/errno.h>
#include <sys/sysctl.h>
int main(int argc, char **argv) {
// Check arguments
if (argc != 2) {
fprintf(stderr,"usage: %s PID\n", argv[0]);
return 1;
}
// Parse and validate PID argument
errno = 0;
char *end = NULL;
long pid = strtol(argv[1], &end, 10);
if (errno != 0 || end == argv[1] || end == NULL || *end != 0 || ((pid_t)pid) != pid) {
fprintf(stderr,"%s: bad PID argument: %s\n", argv[0], argv[1]);
return 1;
}
// Get process info from kernel
struct kinfo_proc info;
int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, (int)pid };
size_t len = sizeof info;
memset(&info,0,len);
int rc = sysctl(mib, (sizeof(mib)/sizeof(int)), &info, &len, NULL, 0);
if (rc != 0) {
fprintf(stderr,"%s: sysctl failed with errno=%d\n", argv[0], errno);
return 1;
}
// Extract start time and confirm process exists
struct timeval tv = info.kp_proc.p_starttime;
if (tv.tv_sec == 0) {
fprintf(stderr,"%s: no such PID %d\n", argv[0], (int)pid);
return 1;
}
// Convert to string - no \n because ctime() result is already \n-terminated
printf("PID %d started at %s", (int)pid, ctime(&(tv.tv_sec)));
return 0;
}
Compile it: clang -o procstart procstart.c
Example of running it:
$ ./procstart $$
PID 37675 started at Sat Apr 9 20:01:55 2022
Note the sysctl API this is calling is undocumented and as such (at least in theory) subject to change at any time. In practice however, it has been rather stable across releases, so while nobody can predict what Apple might do in the future, I think the risk of them breaking this is low.