Launching today
witr
Why is this running? Trace process, port, container or file
44 followers
Why is this running? Trace process, port, container or file
44 followers
ps, top and lsof tell you what is running. witr tells you why. Point it at a process, PID, port, container or file and it traces the chain that explains it - systemd, supervisor, shell or cron - plus who started it, when, from where, and the warnings worth knowing. Run it bare for an interactive TUI with Processes, Ports, Containers and Locks tabs. Or script it: --short for a one-line chain, --json with real exit codes. One static Go binary for Linux, macOS, Windows and BSD.
witr
The thing that'll decide whether I keep it is what it prints when the chain dead ends. A process reparented to init after its parent died, or something started inside a container runtime that hides the real caller, and the honest output there is that it can't tell you. Tools like this get uninstalled the moment they guess once and someone acts on the guess. The --json exit codes are the right instinct, so give the unknown case its own code instead of folding it into success.
The PID reuse case is the one I'd want to understand. Linux recycles PIDs pretty fast under load, so if I point witr at a PID that already exited and got reused by something unrelated, does it know the two are different processes, or could it walk an ancestry chain that's actually stitched together from two different processes that happened to share a number?
This solves something I've dealt with too many times chaining lsof, ps, and systemctl manually just to trace who actually started a process. The ancestry chain approach (systemd → supervisor → cron → shell) is exactly the missing piece.
for containers, does it trace through to the host-level process, or stop at "docker started this"?
Trying the playground now. Nice work.
the single static Go binary shipping for linux, mac, windows and bsd with no runtime dependencies is the kind of boring, disciplined execution that makes a tool actually pleasant to drop on any box