witr

witr is a command-line utility designed to answer the question "Why is this running?" for processes, PIDs, ports, containers, or files. It provides a deeper understanding of system activity by tracing the chain of execution back to its origin, unlike traditional tools like ps, top, or lsof which only show what is currently active. The problem witr addresses is the common frustration of encountering an unknown process, port, or container and having no clear way to determine its purpose or origin. Existing tools can identify the presence of these entities, but they fail to explain the context or the sequence of events that led to their execution. This lack of clarity can lead to confusion, wasted time in debugging, and potential security concerns. One of the core features of witr is its ability to trace the ancestry chain. When pointed at a specific process, PID, port, container, or file, witr reconstructs the sequence of events that led to its existence. This chain can include systemd units, supervisor processes, cron jobs, or shell sessions, providing a comprehensive view of how the target entity was initiated. Another key capability is the identification of the initiator and the timing of the process. witr not only shows who started a process but also when and from where it was launched. This historical context is crucial for understanding system behavior and for auditing purposes. witr also highlights important warnings associated with running processes. This can include information such as a process running as root, binding to all interfaces (0.0.0.0), having a deleted binary, or exhibiting a restart loop. These warnings are vital for system administrators and developers to quickly identify potential issues or misconfigurations. For interactive use, witr offers a Text User Interface (TUI) that presents information across different tabs: Processes, Ports, Containers, and Locks. This TUI allows for live searching and provides an ancestry side panel for quick reference, making it easy to explore system activity in real-time. Beyond the interactive TUI, witr is designed for scripting and automation. It offers a `--short` option for a concise, one-line representation of the ancestry chain and a `--json` output format that includes meaningful exit codes. This makes it suitable for integration into automated workflows and scripts, providing structured data and clear status indicators. The overall approach of witr is to provide a unified and insightful view of process origins. By leveraging system information and tracing parent-child relationships, it offers a more complete picture than disparate command-line tools. Its static Go binary distribution ensures ease of deployment across various operating systems. The benefits for users include faster debugging, improved system understanding, and enhanced security awareness. By quickly identifying the root cause of running processes and associated warnings, users can resolve issues more efficiently and proactively manage their systems. Concrete use cases for witr include diagnosing why a specific port is occupied, understanding the origin of an unexpected process consuming resources, tracing the lifecycle of a containerized application, or investigating file lock contention. For example, a developer might use witr to determine which service is responsible for binding a critical port, or a system administrator could use it to find out why a particular process is consuming excessive CPU. witr is a free, open-source tool available as a single static Go binary for Linux, macOS, Windows, and BSD. It is suitable for developers, system administrators, and anyone who needs to understand the intricacies of process execution on their systems. The tool is licensed under Apache-2.0. In summary, witr is an indispensable tool for system introspection, offering a clear and actionable explanation for why processes are running, thereby simplifying complex debugging and system analysis tasks.