ps, top and lsof tell you what is running. witr tells you why. Point it at a process, PID, port, container or file and it traces the chain that explains it - systemd, supervisor, shell or cron - plus who started it, when, from where, and the warnings worth knowing. Run it bare for an interactive TUI with Processes, Ports, Containers and Locks tabs. Or script it: --short for a one-line chain, --json with real exit codes. One static Go binary for Linux, macOS, Windows and BSD.
Mindcase
How deep does it trace - down to which file handle or socket a process holds? That's usually the part I'm actually hunting for.
witr
@kritishpuri Yes, it goes down to individual sockets and file descriptors (in --verbose mode). Sample output section:
It also works in reverse, which sounds closer to what you're actually hunting. --file finds which process is holding a file and gives you its full ancestry chain, and --port does the same for a socket. The TUI has a locks and ports tab for browsing interactively.
Thanks for the question, and I hope you try it out.
The “unknown” state feels really important for a tool like this. In prod I’d rather see “can’t prove the chain past this point” than a confident-looking guess, especially around PID reuse or containers.
the single static Go binary shipping for linux, mac, windows and bsd with no runtime dependencies is the kind of boring, disciplined execution that makes a tool actually pleasant to drop on any box
witr
@phardinghy4670 Thank you for the awesome comment. Hope you try it out and like it.
Pythagora
witr looks fantastic. Huge congrats on shipping, and best of luck with the launch! 🚀
witr
@leon_ostrez Thank you! Really appreciate the kind words and support. Hope you enjoy using it.
A really cool tool for system administrators! I sent it to our sysadmin to check out.