witr
ps, top and lsof tell you what is running. witr tells you why.
Point it at a process, PID, port, container or file, and it traces the chain that explains it — systemd, supervisor, shell or cron — plus who started it, when, from where, and the warnings worth knowing.
One static Go binary. Linux, macOS, Windows, FreeBSD. Free and open source.
witr --port 8000 --shortsystemd (pid 1) → PM2 v5.3.1: God (pid 1481580) → python (pid 1482060)
Package manager, install script or single binary
Find out what is holding a port in under a minute
Try witr in the browser on a simulated Linux box
The causal chain that is the core of witr
How witr decides what is responsible for a process
Root, public binds, restarts, deleted binaries
The classic address-already-in-use investigation
Docker, Podman, K8s, LXC, jails
Find who holds a lock
Processes, ports, containers and locks in a live dashboard
JSON output and meaningful exit codes
The problem witr solves#
Something is running on your machine. There is always a cause, and that cause is usually indirect: a systemd unit that started a supervisor that started your process, inside a container, launched from a shell you closed two days ago.
Existing tools expose state. ps shows the process, lsof shows the socket, docker ps shows the container. Correlating them into an explanation is manual work you redo every time.
witr makes that causality explicit in one command.
A guided tutorial and a free-play sandbox, running in your browser.