ps, top and lsof tell you what is running. witr tells you why. Point it at a process, PID, port, container or file and it traces the chain that explains it - systemd, supervisor, shell or cron - plus who started it, when, from where, and the warnings worth knowing. Run it bare for an interactive TUI with Processes, Ports, Containers and Locks tabs. Or script it: --short for a one-line chain, --json with real exit codes. One static Go binary for Linux, macOS, Windows and BSD.

Hey Product Hunt! I built witr out of a recurring annoyance: you find something running - a process eating CPU, a port that's already bound, a container you don't remember starting - and every tool tells you what it is, but nothing tells you why it's there. ps, top, lsof and systemctl all answer "what". witr answers "why". Give it a name, PID, port, container or file and it walks the ancestry chain back to whatever is actually responsible - a systemd unit, a supervisor, a cron job, a shell session, a container runtime - and shows who started it, when, from where, and anything worth knowing (running as root, bound to 0.0.0.0, deleted binary, LD_PRELOAD set, restarting in a loop). Run it with no arguments and you get an interactive TUI with Processes, Ports, Containers and Locks tabs, live search and an ancestry side panel. Or script it: --short gives a one-line chain and --json comes with meaningful exit codes. It's a single static Go binary, Apache-2.0, running on Linux, macOS, Windows and FreeBSD. Every operation is read-only, so it's safe to point at production. If you'd rather try before installing, there's a browser playground with a guided tutorial: https://pranshuparmar.github.io/... Would love feedback.

The thing that'll decide whether I keep it is what it prints when the chain dead ends. A process reparented to init after its parent died, or something started inside a container runtime that hides the real caller, and the honest output there is that it can't tell you. Tools like this get uninstalled the moment they guess once and someone acts on the guess. The --json exit codes are the right instinct, so give the unknown case its own code instead of folding it into success.

witr

Why is this running? Trace process, port, container or file

Why is this running? Trace process, port, container or file