From 6eef800ea299a51aaebb9fbd8dc17e28c451ec5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Mon, 31 Aug 2026 19:47:14 +0800
Subject: [PATCH] Top: supports sorting by `start-time`

---
 doc/json_schema.json     | 7 ++++---
 src/detection/top/top.c  | 7 +++++++
 src/modules/top/option.h | 1 +
 src/modules/top/top.c    | 3 +++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/doc/json_schema.json b/doc/json_schema.json
index 1ec527f38..3d43ca94e 100644
--- a/doc/json_schema.json
+++ b/doc/json_schema.json
@@ -4441,16 +4441,17 @@
                                 "properties": {
                                     "type": {
                                         "const": "top",
-                                        "description": "Print processes with the highest CPU or memory usage"
+                                        "description": "Print processes with the highest CPU, memory, disk I/O usage or latest start time"
                                     },
                                     "sort": {
                                         "type": "string",
-                                        "description": "Sort processes by CPU, memory or disk IO usage",
+                                        "description": "Sort processes by CPU, memory, disk IO usage or start time",
                                         "enum": [
                                             "cpu",
                                             "memory",
                                             "disk-read",
-                                            "disk-write"
+                                            "disk-write",
+                                            "start-time"
                                         ],
                                         "default": "cpu"
                                     },
diff --git a/src/detection/top/top.c b/src/detection/top/top.c
index 5c1b8b645..26b5b76db 100644
--- a/src/detection/top/top.c
+++ b/src/detection/top/top.c
@@ -53,6 +53,12 @@ static int compareDiskWriteResults(const FFTopProcessResult* a, const FFTopProce
     if (a->bytesWritten > b->bytesWritten) return -1;
     return (int) (a->pid - b->pid);
 }
+
+static int compareStartTimeResults(const FFTopProcessResult* a, const FFTopProcessResult* b) {
+    if (a->startTime < b->startTime) return 1;
+    if (a->startTime > b->startTime) return -1;
+    return (int) (a->pid - b->pid);
+}
 // clang-format on
 
 const char* ffDetectTopProcesses(FFTopOptions* options, FFlist* result) {
@@ -147,6 +153,7 @@ const char* ffDetectTopProcesses(FFTopOptions* options, FFlist* result) {
     const void* compare = options->sort == FF_TOP_TYPE_DISK_WRITE ? (void*) compareDiskWriteResults
         : options->sort == FF_TOP_TYPE_DISK_READ                  ? (void*) compareDiskReadResults
         : options->sort == FF_TOP_TYPE_MEMORY                     ? (void*) compareMemoryResults
+        : options->sort == FF_TOP_TYPE_START_TIME                 ? (void*) compareStartTimeResults
                                                                   : (void*) compareCpuResults;
     ffListSort(result, sizeof(FFTopProcessResult), (void*) compare);
     if (result->length > options->nProcesses) {
diff --git a/src/modules/top/option.h b/src/modules/top/option.h
index 82a138273..0422d3a8a 100644
--- a/src/modules/top/option.h
+++ b/src/modules/top/option.h
@@ -8,6 +8,7 @@ typedef enum FFTopTypes: uint8_t {
     FF_TOP_TYPE_MEMORY = 1 << 1,
     FF_TOP_TYPE_DISK_READ = 1 << 2,
     FF_TOP_TYPE_DISK_WRITE = 1 << 3,
+    FF_TOP_TYPE_START_TIME = 1 << 4,
 
     FF_TOP_TYPE_DISK = FF_TOP_TYPE_DISK_READ | FF_TOP_TYPE_DISK_WRITE,
 } FFTopTypes;
diff --git a/src/modules/top/top.c b/src/modules/top/top.c
index 7087e38ed..cc39c9977 100644
--- a/src/modules/top/top.c
+++ b/src/modules/top/top.c
@@ -101,6 +101,7 @@ void ffParseTopJsonObject(FFTopOptions* options, yyjson_val* module) {
                                                                        { "memory", FF_TOP_TYPE_MEMORY },
                                                                        { "disk-read", FF_TOP_TYPE_DISK_READ },
                                                                        { "disk-write", FF_TOP_TYPE_DISK_WRITE },
+                                                                       { "start-time", FF_TOP_TYPE_START_TIME },
                                                                        {},
                                                                    });
             if (error) {
@@ -183,6 +184,8 @@ void ffGenerateTopJsonConfig(FFTopOptions* options, yyjson_mut_doc* doc, yyjson_
         yyjson_mut_obj_add_str(doc, module, "sort", "disk-read");
     } else if (options->sort == FF_TOP_TYPE_DISK_WRITE) {
         yyjson_mut_obj_add_str(doc, module, "sort", "disk-write");
+    } else if (options->sort == FF_TOP_TYPE_START_TIME) {
+        yyjson_mut_obj_add_str(doc, module, "sort", "start-time");
     }
     yyjson_mut_obj_add_uint(doc, module, "processes", options->nProcesses);
     yyjson_mut_obj_add_uint(doc, module, "waitTime", options->waitTime);