Traditional system monitoring tools like ps, top, and lsof tell you what is currently running on your system, but they often leave you guessing about the context. witr (created by Pranshu Parmar) bridges this gap by telling you why a process, port, container, or file is running. By pointing it at any of these targets, witr traces the complete lineage and ancestry chain—explaining how it was spawned by systemd, supervisor, a shell, or cron, alongside details on who started it, when, from where, and any relevant warnings.

Designed for flexibility, witr can be run bare to launch an interactive TUI featuring dedicated tabs for Processes, Ports, Containers, and Locks. For automation and scripting, it supports flags like --short for a quick one-line chain and --json with real exit codes. Distributed as a single static Go binary, it is built to run smoothly across Linux, macOS, Windows, and BSD.

Pros of witr

Traces the complete ancestry chain of processes, ports, containers, and files
Interactive TUI mode with dedicated tabs for Processes, Ports, Containers, and Locks
Script-friendly options including --short for one-line chains and --json output with real exit codes
Distributed as a single static Go binary with cross-platform support (Linux, macOS, Windows, BSD)
Open-source developer tool

Cons of witr

Requires manual command-line execution or terminal interaction
Cross-platform compatibility depends on underlying operating system support for specific inspectors (like containers or locks)

Frequently Asked Questions

What is witr?

witr is an open-source developer tool that traces the lineage and ancestry chain of a process, PID, port, container, or file to explain why it is running, who started it, when, and from where.

How do you use witr?

You can run witr bare to open an interactive TUI with Processes, Ports, Containers, and Locks tabs, or use command-line flags like --short for a one-line chain and --json for programmatic scripting.