Re: [PATCH] default ps -W process start time to system boot time when inaccessible, 0, -1

Re: [PATCH] default ps -W process start time to system boot time when inaccessible, 0, -1

[Brian Inglis]

On 2019-03-24 02:18, Achim Gratz wrote:
> Brian Inglis writes:
>> Are there non-startup system processes for which boot time is misleading?
>> If you need the truth use wmic, procexp64, or run ps in an elevated shell.
> 
> I don't seem to get my point across.  I'm fine with getting no start
> time value when that ps wasn't able to obtain that information.  If we
> have to use magic values to convey that information for one reason or
> another, then I'd rather opt for one that is obviously pulled out of
> thin air than for one that I have to compare to some other stuff before
> that becomes clear.

[Cross posting to Cygwin list as this is a more general discussion IMO]

Boot time is neither magic nor pulled out of thin air.
Checking *my* system processes using wmic queries and elevated powershell
scripts, the boot time is at most a few seconds off from process start times
from other sources.
I understand that other systems may run processes where that is not the case.
Please explain why you think this is misleadingly not useful, or where or which
processes have unvailable start times that are not very close to boot time.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [PATCH] default ps -W process start time to system boot time when inaccessible, 0, -1

[Achim Gratz]

Brian Inglis writes:
> Boot time is neither magic nor pulled out of thin air.

No, but other than a lower limit of the process start time it has no
correlation whatsoever to the start time of a process that I am not
proviledged to get the start time from.

> Checking *my* system processes using wmic queries and elevated powershell
> scripts, the boot time is at most a few seconds off from process start times
> from other sources.
> I understand that other systems may run processes where that is not the case.
> Please explain why you think this is misleadingly not useful, or where or which
> processes have unvailable start times that are not very close to boot time.

System processes get started and re-started all the time, as do
processes from other users (interactive or otherwise).

So again: in the case under discussion we _know_ that "0" is a bogus
timestamp value that no process ever got started on, even if it can be
translated to "Jan 1st 1970" if it were indeed a valid timestamp.  All
I'm asking is that ps shows something like "N/A" instead of trying to
print something that looks like it might be a valid time, but still
isn't.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Waldorf MIDI Implementation & additional documentation:
http://Synth.Stromeko.net/Downloads.html#WaldorfDocs

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [PATCH] default ps -W process start time to system boot time when inaccessible, 0, -1

[Brian Inglis]

On 2019-03-24 12:15, Achim Gratz wrote:
> Brian Inglis writes:
>> Boot time is neither magic nor pulled out of thin air.
> No, but other than a lower limit of the process start time it has no
> correlation whatsoever to the start time of a process that I am not
> proviledged to get the start time from.
>> Checking *my* system processes using wmic queries and elevated powershell
>> scripts, the boot time is at most a few seconds off from process start times
>> from other sources.
>> I understand that other systems may run processes where that is not the case.
>> Please explain why you think this is misleadingly not useful, or where or which
>> processes have unvailable start times that are not very close to boot time.
> System processes get started and re-started all the time, as do
> processes from other users (interactive or otherwise).

System processes with more recent process start times seem to make process times
available to unelevated processes.
Do startup system processes not have this info available to unelevated processes
because of some security policy, timing, or possible race conditions with system
process and performance monitor startup?

> So again: in the case under discussion we _know_ that "0" is a bogus
> timestamp value that no process ever got started on, even if it can be
> translated to "Jan 1st 1970" if it were indeed a valid timestamp.  All
> I'm asking is that ps shows something like "N/A" instead of trying to
> print something that looks like it might be a valid time, but still
> isn't.

System startup process start times appear to not be available to unelevated
processes, so the process default value is zero.
ISTM boot time is a better, more accurate, and useful default for those processes.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [PATCH] default ps -W process start time to system boot time when inaccessible, 0, -1

[Achim Gratz]

Brian Inglis writes:
> System processes with more recent process start times seem to make process times
> available to unelevated processes.
> Do startup system processes not have this info available to unelevated processes
> because of some security policy, timing, or possible race conditions with system
> process and performance monitor startup?

I don't understand why you keep talking exclusively about system startup
processes, these are just a subset (if a particularly stubborn one).

The process start time info is generally unavailable for an unprivileged
user (since it requires to "open" the process") except for processes
started under the same user account in the same user session.  There is
a security token (I forgot the name, but it's been posted on this list a
few days ago) you can add to user accounts so they get to see more (but
still not all) such information.  Certain types of information are only
accessible conditional on which groups you're a member of.  It also
varies a bit by Windows version and type of install, I think.  On top of
that come group policies.  So this is a lot more involved than just
system startup processes.

> System startup process start times appear to not be available to unelevated
> processes, so the process default value is zero.
> ISTM boot time is a better, more accurate, and useful default for those processes.

I still disagree, but then those are not the only processes that have
this issue.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Wavetables for the Terratec KOMPLEXER:
http://Synth.Stromeko.net/Downloads.html#KomplexerWaves

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple