witr: Uncover Why Processes Are Running on Your System
witr: The Ultimate Tool to Answer 'Why Is This Running?' on Your System
In the world of system administration and debugging, one question haunts every sysadmin: "Why is this running?" Whether it's a mysterious process hogging CPU, a service binding to a port, or a container that won't quit, traditional tools like ps, top, lsof, or systemctl show what is running—but not why. Enter witr, a game-changing open-source CLI tool that makes causality explicit.
What Makes witr Stand Out?
Developed in Go and boasting 10.9k GitHub stars, witr traces the full ancestry chain of any process, service, or port. It reveals how something started (e.g., via systemd, pm2, Docker, or cron) and what's keeping it alive. Key goals: - Zero configuration - Read-only and safe - Human-readable output - Single-screen summaries
Non-goals include monitoring or auto-fixing—witr focuses purely on clarity during incidents.
Lightning-Fast Installation
witr is a single static binary, packaged everywhere:
Quick Scripts (Recommended for Testing)
Linux/macOS/FreeBSD:
curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash
Windows (PowerShell):
irm https://raw.githubusercontent.com/pranshuparmar/witr/main/install.ps1 | iex
Package Managers
- Homebrew:
brew install witr - Conda/Mamba/Pixi:
conda install -c conda-forge witr - Arch (AUR):
yay -S witr-bin - FreeBSD:
pkg install sysutils/witr - More: AOSC OS, GNU Guix, deb/rpm/apk from releases.
Verify: witr --version or man witr.
Core Usage: Target Anything
witr converges all queries to PID analysis:
- By name: witr node or witr nginx
- By PID: witr --pid 14233
- By port: witr --port 5000
Sample Output
Target: node
Process: node (pid 14233) | User: pm2 | Started: 2 days ago | Restarts: 1
Why It Exists: systemd (pid 1) → pm2 (pid 5034) → node (pid 14233)
Source: pm2
Working Dir: /opt/apps/expense-manager
Git Repo: expense-manager (main)
Listening: 127.0.0.1:5001
Flags for Power Users:
- --short: One-liner summary
- --tree: Process ancestry tree
- --json: Machine-readable
- --warnings: Security alerts only (e.g., root process, public binds)
Cross-Platform Mastery
| Feature | Linux | macOS | Windows | FreeBSD |
|---|---|---|---|---|
| Process Info | ✅ | ✅ | ✅ | ✅ |
| systemd/launchd | ✅ | ✅ | - | rc.d ✅ |
| Containers (Docker) | ✅ | ⚠️ | - | Jails ✅ |
Run with sudo for full access on restricted systems.
Why Sysadmins Love It
witr slashes debugging time from minutes of tool-hopping to seconds. Perfect for outages, audits, or curiosity. With 29 contributors and active releases (latest v0.2.4), it's production-ready under Apache-2.0.
Get started now: Clone from GitHub, install, and run witr --help. Your systems will thank you.
Stars: 10.9k | Forks: 244 | Platforms: Linux/macOS/Windows/FreeBSD