C# Discussion Boards - CodeProject

CCodeNewbie18-Mar-12 4:47

18-Mar-12 4:47

I would like to get the date & time that the process started.

The process start date/time is in nano seconds (Ticks) whose value is the difference between now and 01/01/1601 00:00:00 + the start date/time.

Thus, startdate/time = a
01/01/1601 00:00:00 = b
now = c

startdate/time = c - a + b

what is the syntax?

Dave Kreskowiak18-Mar-12 7:26

Dave Kreskowiak

18-Mar-12 7:26

Wouldn't it be far easier to get that from the Process.StartTime property for the process in question?

Documentation can be found here[^].

A guide to posting questions on CodeProject[^]

Dave Kreskowiak

CCodeNewbie18-Mar-12 7:32

18-Mar-12 7:32

Hi Dave,

The "System" process isn't enumerable as part of Process.GetProcesses. It has to be isolated.

I can get all the processes quite easily except for "Idle" - not enumerable & "System" - independently enumerable.

Thanks for your answer though.

jschell18-Mar-12 7:26

jschell

18-Mar-12 7:26

CCodeNewbie wrote:
I would like to get the date & time that the process started.

Err....

DateTime startTime = DateTime.Now;

CCodeNewbie18-Mar-12 7:41

18-Mar-12 7:41

Hi jschell,

Not sure that you mean.

The process started ~8 days ago but when I can't get that value from process.starttime because it is a tickcount.

Using a tickcount method I get many different answers, none of which are correct (when they don't error that is.

Using a timespan I get 150191.15:00:50.2796717 which is roughly 411 years ago. This means (to me) that the starttime is "stuck" at 1601,1,1,0,0,0.

It looks like the starttime is not directly enumerable as a datetime and has to be deduced.

Thanks for your reply.

booted=DateTime.Now.AddMilliseconds(-Environment.TickCount);

jschell19-Mar-12 8:30

jschell

19-Mar-12 8:30

CCodeNewbie wrote:
Not sure that you mean.

When your application starts you collect that value.
You use it, not update it, after that.

Luc Pattyn18-Mar-12 9:46

Luc Pattyn

18-Mar-12 9:46

Oh my.

1.

CCodeNewbie wrote:
is in nano seconds (Ticks)

no, ticks is not the same as nanoseconds.

2. forget about 1601, there were no computers back then. Use DateTime exclusively, without worrying about its origin. Just add ticks, seconds, or whatever it is you have.

3. from another of your posts, I get it your description is still no good, as you want to know when the idle process got launched, which amounts to when the system got booted. There is this[^] to handle that, mind you, they unfortunately have chosen a very confusing property name.

Hmmm | :|

Luc Pattyn [My Articles] Nil Volentibus Arduum

BobJanova19-Mar-12 0:20

19-Mar-12 0:20

You shouldn't normally be messing around with ticks but since you already have that format:

final DateTime epochStart = new DateTime(1600, 01, 01, 0, 0, 0);
DateTime startTime = new DateTime(ticks - epochStart.Ticks);

And make sure that 'ticks' actually means the same thing. DateTime[^] thinks it means 100ns.

CCodeNewbie19-Mar-12 1:25

19-Mar-12 1:25

Hi Bob,

Thanks for your reply but I think you may have lost me a bit as I am not sure which of the examples you reply refers to.

I am also not familiar with "final" as VS2005 won't recognise the "DateTime" portion of "final DateTime epochStart"

Do you mean I should do something like:

long dt1 = DateTime.Now.Ticks;
long dt2 = procs.StartTime.Ticks;
long ticks = dt1 - dt2;
DateTime epochStart = new DateTime(1600, 01, 01, 0, 0, 0);
DateTime startTime = new DateTime(ticks - epochStart.Ticks);

Sorry if it's a stupid question but I have been around-and-around this problem so many times that I have lost a grip on it and was about to exclude the starttime value from the code altogether.

BobJanova19-Mar-12 1:44

19-Mar-12 1:44

Uh sorry, I've been writing Java, try 'readonly' (probably 'static readonly'). epochStart can be a psuedo-constant at the class level as it will never change.

I don't understand why you keep trying to bring Now into the equation. The start time is defined by the epoch start and its tick count, nothing to do with the present.

If you have procs.StartTime then, well, I don't understand the problem any more because that is what you are trying to find, right? Just use that DateTime directly ...

CCodeNewbie19-Mar-12 3:22

19-Mar-12 3:22

Thanks for your patience Bob,

Not sure why I included the Now operation in my post to you, sorry.

OK, so I tried this

long dt2 = procs.StartTime.Ticks;
DateTime epochStart = new DateTime(1600, 01, 01, 0, 0, 0);
DateTime startTime = new DateTime(dt2 - epochStart.Ticks);

and got
02/01/0002 00:00:00

if I go

DateTime startTime = new DateTime(dt2 + epochStart.Ticks);

I get 01/01/3200 00:00:00.

Interestingly (?) though, if I do this

long st = procs.StartTime.ToFileTime();

depite Luc's instructions, I get 504911232000000000. Dividing that by DateTime Ticks (10000000) I get 504911232 which is 31/12/1985 21:07:12 according to http://www.epochconverter.com/[^]

I think I need to pursue the method described in my reply to Alan's post.

BobJanova19-Mar-12 3:52

19-Mar-12 3:52

What is procs.StartTime? Is it this property[^]? That's already a DateTime.

Edit: just seen Alan's post, apparently this property gives you a nonsense value (which you could have checked with the debugger).

CCodeNewbie19-Mar-12 4:21

19-Mar-12 4:21

full(ish) code, I am inserting the data int a SQL db thus the "inprocs" stuff...

Process[] processlist = Process.GetProcesses();
foreach (Process procs in processlist)
{
if (procs.ProcessName == "System")
    {
        insprocs.Parameters.Add("@PStart", SqlDbType.NVarChar, 30).Value = startTime.ToString();
    }
}

I am currently ToString-ing it for testing but that may/may not remain the case.

If you try to GetProcesses without separating out the "System" (and "Idle")process,even though it is a DateTime, you get the error "System.ComponentModel.Win32Exception: Unable to enumerate the process modules", probably because of the "System" process's starttime properties.

So I am running GetProcesses 3 times-
1) if ((procs.ProcessName != "Idle") && (procs.ProcessName != "System")) // get everything
2) if (procs.ProcessName == "System") // get everything except "MainModule.FileName" (unenumerable for the System process)
3) if (procs.ProcessName == "Idle") // get only ProcessID, ProcessName (I think I can get RAM in use but I am not sure yet)

Depending on how you manipulate the starttime value, you get different values.

BobJanova19-Mar-12 6:37

19-Mar-12 6:37

Process.StartTime is a DateTime. 'Manipulating' it means converting it into some other form that will give you a wrong answer. Now, according to Alan, on the System process this will give you a nonsense answer. That just means that Windows will not give you a sensible answer for that process (presumably because it's not a real process and various things in Windows internals are faking it). If you don't want that nonsense answer in your DB, then you need to use one of the other approaches to calculate a different value.

CCodeNewbie19-Mar-12 6:59

19-Mar-12 6:59

Yup, that's pretty much where I am at the moment too, at least until I can figure out the relationship between a known bootup time and the long st = procs.StartTime.ToFileTime().

I have gone back to this, but am struggling to work out how to make "stime" available;

long st = procs.StartTime.ToFileTime();
DateTime stDt = new DateTime(1601, 1, 1, 0, 0, 0).AddSeconds(st);
string stime = String.Empty;
stime += (Environment.TickCount / 86400000).ToString() + ",";
stime += Convert.ToInt32(Environment.TickCount / 3600000 % 24) + ",";
stime += Convert.ToInt32(Environment.TickCount / 120000 % 60) + ",";
stime += (Environment.TickCount / 1000 % 60); // yields 7,10,11,49
DateTime result = DateTime.Now - new TimeSpan(stime);

currently erroring with "System.FormatException: Input string was not in a correct format."

CCodeNewbie19-Mar-12 12:18

19-Mar-12 12:18

Hi Bob,

Other approach used..[^]... can't figure out why I get 2 different results though...

Thanks for all your time today Smile | :)

CCodeNewbie18-Mar-12 8:24

Since I can't reply to Luc's message

18-Mar-12 8:24

Hi Luc,

Tried you code like so

DateTime dt1 = DateTime.Now;
TimeSpan span = dt1 - procs.StartTime;
string text1 = span.Days + "d " + span.Hours + "h " + span.Minutes + "m " + span.Seconds + "s";
string text2 = span.ToString();

result - 150191d 18h 18m 21s

How am I supposed to translate that in to 10/03/2012 09:15:22 (which is the approximate process start time)?

CCodeNewbie18-Mar-12 10:00

Re: Since I can't reply to Luc's message

18-Mar-12 10:00

My bad, I meant to say Ticks are 100 nanosecond units.

TickCount becomes inaccurate (without conditional calculation) if the system is up for more than 24,9 days

To get system uptime I used this

DateTime Utime = new DateTime(1970, 1, 1).AddSeconds(t);
string uptime = String.Empty;
uptime += (Environment.TickCount / 86400000).ToString() + "d";
uptime += (Environment.TickCount / 3600000 % 24) + "h";
uptime += (Environment.TickCount / 120000 % 60) + "m";
uptime += (Environment.TickCount / 1000 % 60) + "s";

Ravi Bhavnani18-Mar-12 18:03

Ravi Bhavnani

18-Mar-12 18:03

This bit of code will give you the system uptime regardless of how long the system has been running:

TimeSpan uptime = TimeSpan.Zero;
using (var ut = new PerformanceCounter("System", "System Up Time")) {
  ut.NextValue();
  uptime = TimeSpan.FromSeconds (ut.NextValue());
}

/ravi

My new year resolution: 2048 x 1536
Home | Articles | My .NET bits | Freeware
ravib(at)ravib(dot)com

Alan N19-Mar-12 2:58

Alan N

19-Mar-12 2:58

The Windows "System" process has a StartTime value of 01/01/1601 00:00:00. It is what it is and there is nothing you can do to transform the value into the actual start time of the process.

You have to accept that Windows is not giving you the start time and assume that 01/01/1601 means "not available". If you want to assign a hypothetical start time corresponding to computer's boot time then do so, but be clear in your own mind that the calculation you do to get that has nothing to do with January 1, 1601.

Alan.

modified 19-Mar-12 9:10am.

CCodeNewbie19-Mar-12 3:06

19-Mar-12 3:06

Hi Alan,

I am aware of the unix epoch time value for Window's "System" process starttime but I have to disagree that it is 01/01/1601, that is just what it reports.

As I posted in my original question, if you do this

string stime = String.Empty;
stime += (Environment.TickCount / 86400000).ToString() + "d";
stime += (Environment.TickCount / 3600000 % 24) + "h";
stime += (Environment.TickCount / 120000 % 60) + "m";
stime += (Environment.TickCount / 1000 % 60) + "s";

you can get the amount of time that the process has been running. From that, a better coder than I could deduce the starttime by somehow converting the resultant stime string to a datetime then subtracting it from datetime.now.

Alan N19-Mar-12 3:54

Alan N

19-Mar-12 3:54

1) Unix time's epoch is 1/1/1970
2) 01/01/1601 is the epoch for Windows FileTime which is used by the operating system to report process start times. See for example the documentation for the win32 function GetProcessTimes[^].
3) I stand by my assertion that a reported process start time of 01/01/1601 is Windows way of telling you that it's not telling you.
4) Has this whole thread been about this?

private void Boot() {
  DateTime boot = DateTime.Now - TimeSpan.FromMilliseconds(Environment.TickCount);
  Console.WriteLine("System started at {0}", boot);
}

Alan.

CCodeNewbie19-Mar-12 4:23

19-Mar-12 4:23

Hi,

4) No, I already have a way to get the system uptime, I would like to get a full listing of all processes and as much information as I can get for each process.

Will get back to you on the others.

BobJanova19-Mar-12 3:56

19-Mar-12 3:56

Well isn't that strange.

Okay, Environment.TickCount it is, but that resets every 2³² ms, so that's not really useful either.