witr
Why is this running?
A command-line tool that shows why a process or network port is running, tracing the full chain from container to supervisor, in one readable report or interactive terminal dashboard, replacing several monitoring commands at once.
witr is a command-line tool that answers a single question about a running computer process: why is this running? When a program, service, or something listening on a network port is alive on a machine, there is always a reason — but it is often hidden across several layers, like a supervisor that launched a container that launched a service that opened a shell. The usual Unix tools (ps, top, lsof, ss, systemctl, docker ps) show what is running, but make you piece together the why by jumping between their outputs.
witr collapses that detective work into one report. You point it at a running thing and it explains where it came from, how it was started, and the chain of systems responsible for keeping it alive, presented as a human-readable text dump or as an interactive terminal dashboard (a TUI, short for text user interface). The README organizes the tool by purpose, installation, the TUI mode, flags, example outputs, supported platforms, design goals, and the core idea behind making causality explicit. It ships as a single static binary with no runtime dependencies and includes a man page on Unix-style systems.
You would use witr when something on a server is consuming resources, holding a port, or behaving unexpectedly, and you want a plain explanation of how it got there rather than juggling multiple monitoring commands. It is written in Go and runs on Linux, macOS, FreeBSD, and Windows. Installation works through an install script or through package managers including Homebrew, Conda, the Arch User Repository, Winget, npm, FreeBSD Ports, Chocolatey, Scoop, AOSC OS, and GNU Guix, with status tracked on Repology. The full README is longer than what was provided.
Where it fits
- Find out which service or container started an unexpected process that is holding a port on your server.
- Trace the parent chain of a process consuming CPU or memory to identify which supervisor is responsible.
- Use the interactive TUI dashboard to explore and monitor running processes across system layers without juggling multiple commands.