What is witr?
witr is a command-line diagnostic tool that answers a question traditional system tools leave open: why is this running? While ps, top, and lsof show you what is running, witr traces the causal chain behind any process, port, container, or file — revealing the systemd unit, supervisor, shell, or cron job that started it, along with who initiated it, when, and from where. It ships as a single static Go binary for Linux, macOS, Windows, and BSD, and offers both an interactive TUI and scriptable output modes.
Who it's for
- System administrators — quickly untangle complex service hierarchies and identify which supervisor or init system is responsible for a given process.
- DevOps and SRE engineers — debug containerized workloads and port conflicts by tracing ownership chains across layers like Docker, systemd, and shells.
- Security analysts and incident responders — investigate suspicious processes by revealing their origin, start time, and launching context without juggling multiple tools.
Key features
Interactive TUI dashboard
Run witr bare and you get a full-screen terminal interface with dedicated tabs for Processes, Ports, Containers, and Locks. Navigate live system state, drill into any entry, and see its causal chain rendered immediately — no flags or arguments required.
Scriptable output modes
For automation, witr offers --short for a concise one-line chain summary and --json for structured output with real exit codes. This makes it easy to integrate into monitoring scripts, CI pipelines, or custom alerting workflows.
Cross-platform static binary
One compiled binary works across Linux, macOS, Windows, and BSD — no runtime dependencies, no interpreter requirements. Installation is available via curl script, PowerShell, or package managers like Homebrew, APT, Conda, and MacPorts.
Causality tracing, not just state
Unlike lsof or ss, witr doesn't stop at listing what's bound to a port or which process holds a file. It walks the full chain of responsibility — from the immediate parent up through supervisors, containers, and init systems — so you see the reason something exists, not just its metadata.
What stands out
witr turns "what is running?" into "why is this running?" — and that changes how you debug systems.
Most troubleshooting tools give you a snapshot; witr gives you a story. Instead of manually correlating output from five different utilities to piece together how a process came to be, witr delivers the answer in one command. The combination of an interactive TUI for exploration and JSON output for automation means it fits both ad-hoc debugging and systematic monitoring — a rare breadth in a single tool.
Worth checking out if…
You've ever stared at a mysterious process and wondered where it came from, or spent twenty minutes tracing a port conflict through systemd, Docker, and shell scripts. If you value tools that explain causality rather than just exposing state, witr is worth a look. It's especially valuable for anyone who manages mixed environments — the same binary works on your Linux servers, macOS laptop, Windows workstation, and BSD appliances.
