
Why is this running? Trace process, port, container or file
ps, top and lsof tell you what is running. witr tells you why. Point it at a process, PID, port, container or file and it traces the chain that explains it - systemd, supervisor, shell or cron - plus who started it, when, from where, and the warnings worth knowing. Run it bare for an interactive TUI with Processes, Ports, Containers and Locks tabs. Or script it: --short for a one-line chain, --json with real exit codes. One static Go binary for Linux, macOS, Windows and BSD.
Witr is an open-source tool that traces the origin and context of running processes, ports, containers, or files on Linux systems. It provides detailed insights into the process chain, including the initiator and relevant warnings, and can be used interactively or scripted for automation.