different of  real user sys time 

 When we use $time command ,output just like following,

$time ls

real 0m0.007s

user 0m0.004s

sys 0m0.000s

why real!=user+sys.

Real refers to actual elapsed time; User and Sys refer to CPU time used only by the process.

• Real is wall clock time - time from start to finish of the call. This is all elapsed time including time slices used by other processes and time the process spends blocked (for example if it is waiting for I/O to complete).

• User is the amount of CPU time spent in user-mode code (outside the kernel) within the process. This is only actual CPU time used in executing the process. Other processes and time the process spends blocked do not count towards this figure.

• Sys is the amount of CPU time spent in the kernel within the process. This means executing CPU time spent in system calls within the kernel, as opposed to library code, which is still running in user-space. Like 'user', this is only CPU time used by the process. See below for a brief description of kernel mode (also known as 'supervisor' mode) and the system call mechanism.

User+Sys will tell you how much actual CPU time your process used.

So $strace time ls 

i get 

.......

gettimeofday({1263467995, 282946}, NULL) = 0

clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb774b728) = 5030

rt_sigaction(SIGINT, {0x1, [INT], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0

rt_sigaction(SIGQUIT, {0x1, [QUIT], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0

wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, {ru_utime={0, 4000}, ru_stime={0, 0}, ...}) = 5030

--- SIGCHLD (Child exited) @ 0 (0) ---

gettimeofday({1263467995, 292113}, NULL) = 0

.........

real time just use the gettimeofday() function;

and the sys,user use the wait4() syscall ,and get the data from getrusage structure .

 

1. struct rusage {
2.     struct timeval ru_utime; /* user time used */
3.     struct timeval ru_stime; /* system time used */
4.     long   ru_maxrss;        /* maximum resident set size */
5.     long   ru_ixrss;         /* integral shared memory size */
6.     long   ru_idrss;         /* integral unshared data size */
7.     long   ru_isrss;         /* integral unshared stack size */
8.     long   ru_minflt;        /* page reclaims */
9.     long   ru_majflt;        /* page faults */
10.     long   ru_nswap;         /* swaps */
11.     long   ru_inblock;       /* block input operations */
12.     long   ru_oublock;       /* block output operations */
13.     long   ru_msgsnd;        /* messages sent */
14.     long   ru_msgrcv;        /* messages received */
15.     long   ru_nsignals;      /* signals received */
16.     long   ru_nvcsw;         /* voluntary context switches */
17.     long   ru_nivcsw;        /* involuntary context switches */
18. };

So , taking 

resources like memory, I/O , IPC calls and OS's timeslice mechanism  into account.

why real !=sys+user time ,just clear!

Actually ,we discuss which application or program is more fast ,that means the           

sys+user  time.

So ,how measure  the system or user time .

copy the code 

1. long
2. get_run_time ()
3. {
4. #if defined (HAVE_GETRUSAGE) && defined (HAVE_SYS_RESOURCE_H)
5.   struct rusage rusage;
6.   getrusage (0, &rusage);
7.   return (rusage.ru_utime.tv_sec * 1000000 + rusage.ru_utime.tv_usec
8.  + rusage.ru_stime.tv_sec * 1000000 + rusage.ru_stime.tv_usec);
9. #else /* ! HAVE_GETRUSAGE */
10. #ifdef HAVE_TIMES
11.   struct tms tms;
12.   times (&tms);
13.   return (tms.tms_utime + tms.tms_stime) * (1000000 / GNU_HZ);
14. #else /* ! HAVE_TIMES */
15.   /* Fall back on clock and hope it's correctly implemented. */
16.   const long clocks_per_sec = CLOCKS_PER_SEC;
17.   if (clocks_per_sec <= 1000000)
18.     return clock () * (1000000 / clocks_per_sec);
19.   else
20.     return clock () / clocks_per_sec;
21.  
22. #endif  /* HAVE_TIMES */
23. #endif  /* HAVE_GETRUSAGE */
24. }