Warnings

Warnings are non-blocking observations. They do not mean something is broken — they mean something is worth a second look before you move on.

Show only warnings with --warnings. A process with one or more warnings exits with code 1, which makes this scriptable — see Exit Codes.

Running as root

The process has full system privileges. Common and often correct for system services, worth questioning for an application process.

Dangerous Linux capabilities on a non-root process

A process that is not root but holds capabilities like CAP_SYS_ADMIN. This is the sort of thing that looks safe in a process listing and is not. Linux only.

Listening on a public interface

The process is bound to 0.0.0.0 or :: rather than loopback. If you expected it to be reachable only from the machine itself, it is not.

Restarted multiple times

The restart count is above the threshold, which usually means a crash loop that a supervisor is quietly papering over.

High memory usage

Resident memory above 1 GB. Sometimes normal, sometimes the first visible sign of a leak.

Running for over 90 days

A long-lived process that has outlasted several deploys, and may be running code you no longer have.

Deleted binary

The executable backing the process no longer exists on disk — typically an upgrade that replaced the binary without restarting the service. The running code and the code on disk are different.

Library injection indicators

LD_PRELOAD or DYLD_* environment variables that alter what libraries the process loaded.

Using warnings in scripts#

witr nginx --warnings
if [ $? -eq 1 ]; then
  echo "nginx is running but something is off"
fi

Combine with --json for machine-readable output in monitoring pipelines. See Scripting and CI.