Output sections

What you asked about — the name, PID, port, file or container from your command. With multiple targets, each result block repeats its own Target line under a labeled divider.

The executable, PID, user, full command line, start time and restart count.

A high restart count is also surfaced as a warning, since it usually means a crash loop.

The causal ancestry chain, from init down to the target process. This is the core value of the tool — everything else is context around it.

systemd (pid 1) → pm2 (pid 5034) → node (pid 14233)

Explained in full in Why It Exists.

The primary system responsible for starting or supervising the process. Exactly one source is selected, best effort.

Candidates include systemd units with schedule information for timers, launchd services, Windows services, SSH sessions with remote IP and terminal, Docker containers, pm2, cron, interactive shells with tmux or screen session names, and Snap or Flatpak sandboxes. See Sources.

Best-effort surroundings: working directory, git repository name and branch, container name and image, and whether the bind is public or private.

Non-blocking observations — running as root, dangerous capabilities, public interface binds, repeated restarts, high memory, very long uptime, deleted binaries, library injection indicators. Each one is described in Warnings.