Show Hn: Witr – Explain Why A Process Is Running On Your Linux System

When something is running on a system—whether it is a process, a service, or something bound to a port—there is always a cause. That cause is often indirect, non-obvious, or spread across multiple layers such as supervisors, containers, services, or shells.

Existing tools (ps, top, lsof, ss, systemctl, docker ps) expose state and metadata. They show what is running, but leave the user to infer why by manually correlating outputs across tools.

It explains where a running thing came from, how it was started, and what chain of systems is responsible for it existing right now, in a single, human-readable output.

Ports, services, containers, and commands all eventually map to PIDs. Once a PID is identified, witr builds a causal chain explaining why that PID exists.

witr supports multiple entry points that converge to PID analysis.

A single positional argument (without flags) is treated as a process or service name. If multiple matches are found, witr will prompt for disambiguation by PID.

Executable, PID, user, command, start time and restart count.

A causal ancestry chain showing how the process came to exist. This is the core value of witr.

The primary system responsible for starting or supervising the process (best effort).

A single positional argument (without flags) is treated as a process or service name.

Source: HackerNews