Skip to content
Search

Witr

lastmod 2025-12-29created 2025-12-291 edits

A tool that explains why a process is running on a Linux system

About

  • Witr (why-is-this-running) is a tool that clearly shows why a particular process, service, or port is running on a Linux system
  • Unlike existing tools such as ps, top, and lsof, which only show “what is running”, it displays the causal relationship of “why it is running” on a single screen
  • Uses PID-based analysis to trace a process's origin, execution path, what keeps it alive, and the context it belongs to
  • Explains the cause of execution by linking with various sources such as systemd, docker, pm2, cron, and shell, and operates read-only and non-destructively
  • A tool that shortens the time needed to understand things during debugging and incident response, and lets you grasp the execution structure of a complex system at a glance

Purpose and concept

  • Witr's core question is “Why is this running? (why-is-this-running)”
    • Traces the origin and cause of everything that is running, such as processes, services, and ports
    • Explicitly shows indirect causes of execution that span multiple layers (supervisor, container, service, shell, etc.)
  • While existing tools provide only state and metadata, Witr clearly expresses causal relationships
  • As a result, it outputs “what is running, how, why, and in what context” in a human-readable form

Key goals

  • Explain why a process exists, providing more than whether it is simply running
  • Shorten debugging and incident response time
  • Usable right away with no configuration; read-only and safe
  • Prioritize clarity over completeness
  • Does not include monitoring, performance analysis, or automatic recovery features

How it works

  • Interprets every target in terms of processes (PIDs)
    • Ports, services, containers, and commands are all linked to PIDs
    • Builds an execution causal chain based on the PID
  • Four core questions
    • What is running
    • How did it start
    • What is keeping it running
    • What context does it belong to

Supported targets

  • Supports process/service names, PIDs, and port numbers as input targets
    • When a name is given and several processes match, it asks you to choose a PID
    • The --pid and --port options allow analysis based on a specific process or port

Output structure

  • Target: the target specified by the user
  • Process: executable, PID, user, command, start time, restart count
  • Why It Exists: the process's causal ancestry chain
  • Source: the main system responsible for the execution (e.g., one of systemd, docker, pm2, cron, shell)
  • Context: working directory, Git repository, Docker container, bind information, etc.
  • Warnings: non-blocking warnings such as running with root privileges, listening on a public interface, long-running, excessive memory usage, etc.

See also

Favorite site

author Zer0 sitemap