Click here to Skip to main content
Click here to Skip to main content


, 4 May 2004
Rate this:
Please Sign up or sign in to vote.
How to retrieve the running-time of a process

Sample Image - ProcessInfo.jpg


This article is a brief explanation of how to use the GetProcessTimes API. There are times when knowing how long a process has been running might be useful.

The time values returned from GetProcessTimes are fairly easy to convert into something useful/readable. Let's operate on this code snippet:

HANDLE hProcess;
</CODE>FILETIME ftCreation,

GetProcessTimes(hProcess, &ftCreation, &ftExit, &ftKernel, &ftUser);

Calculating running-time

A processes' running-time is the amount of time that has elapsed between the current time and the processes' creation time. This is stored in a FILETIME structure.

Once the elapsed time is calculated, then it's a matter of converting it to hours, minutes, seconds, etc. Luckily, the COleDateTime class makes this a painless process.

COleDateTime timeNow = COleDateTime::GetCurrentTime(),
timeCreation = ftCreation;
COleDateTimeSpan timeDiff = timeNow - timeCreation;

From here, you can use the different methods of COleDateTimeSpan to get the elapsed hours, minutes, etc.

Calculating kernel and user times

Per the documentation, the kernel and user times are amounts of time rather than an actual time period. The value in the FILETIME structure is expressed in 100-nanosecond units. To convert that to something useful, let's look at two methods.

Method 1

We can convert that to seconds with some basic arithmetic. A nanosecond is one billionth of a second, but since the time is already expressed in 100-nanosecond units, we'll only divide by 10 million:

__int64 i64Kernel = *((__int64 *) &ftKernel);
DWORD dwKernel = (DWORD) (i64Kernel / 10000000U);

As an alternative to the casting used above, a union could have just as easily been employed:

FILETIME ftKernel;
__int64 i64Kernel;
} timeKernel;

timeKernel.ftKernel = ftKernel;
DWORD dwKernel = (DWORD) (timeKernel.i64Kernel / 10000000U);

Either way, dwKernel now represents the number of elapsed seconds that the process has been in kernel mode. Converting seconds to hours, minutes, and seconds is a straightforward process.

Method 2

An alternative method that does not require anything other than a function call is to use the FileTimeToSystemTime API. This stores the result in a SYSTEMTIME structure, where we then have access to the wHour, wMinute, and wSecond members.

FileTimeToSystemTime(&ftKernel, &stKernel);

The user-mode time is handled in the same way as kernel-mode time.


That's all there is to it. Looking at all of this together yields:

GetProcessTimes(hProcess, &ftCreation, &ftExit, &ftKernel, &ftUser);

timeCreation = ftCreation;

strData.Format("Created at %02d:%02d:%02d", timeCreation.GetHour(), 
               timeCreation.GetMinute(), timeCreation.GetSecond());

timeDiff = timeNow - timeCreation;
strData.Format("Elapsed time = %ud %uh %um %us", timeDiff.GetDays(), 
               timeDiff.GetHours(), timeDiff.GetMinutes(), 

FileTimeToSystemTime(&ftKernel, &stKernel);
strData.Format("Time in kernel mode = %uh %um %us", stKernel.wHour,
               stKernel.wMinute, stKernel.wSecond);


The way the demo code is currently written, some system-level processes did not allow their name and time-information to be retrieved.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Software Developer (Senior) Pinnacle Business Systems
United States United States

The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
HTTP 404 - File not found
Internet Information Services

Comments and Discussions

QuestionHow to get cpu cycles Pinmemberamarzee17-Sep-03 1:10 
AnswerRe: How to get cpu cycles PinmemberDavidCrow22-Apr-04 4:39 
GeneralIdle Apps Pinsussm.bergman1-Aug-03 6:29 
I noticed that GetProcessTimes returns the same user time and kernel time if the application is idle; that is, if I have an application which has been idle for eight hours, the user time at the end of that eight hours is the same as the beginning of the eight hours. Same goes for the kernel time.
How can I differentiate an idle application from a frozen application?
GeneralRe: Idle Apps PinmemberDavidCrow1-Aug-03 6:50 
GeneralProcess times under Win9x PinmemberMarc Heiligers23-Jun-03 22:09 
GeneralCheck Article Pinmemberwhizer19-Jun-03 6:21 
GeneralRe: Check Article PinmemberDavidCrow19-Jun-03 7:11 
GeneralRe: Check Article Pinmemberwhizer19-Jun-03 10:40 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.150327.1 | Last Updated 5 May 2004
Article Copyright 2003 by DavidCrow
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid