witr — Why Is This Running?
CLI tool that answers "Why is this running?" by tracing process ancestry chains, supervisor relationships (systemd, launchd, Docker, PM2, tmux, SSH), containers, and service managers.
Installation
brew install witr
Commands
witr process explain <name> — Explain why a process is runningwitr process explain systemd-journald — Explain a specific processwitr _ _ --exact <name> — Exact name match (passthrough)witr _ _ --pid <n> — Explain by PIDwitr _ _ --port <n> — Explain what's on a portwitr _ _ --json <name> — JSON outputwitr self version — Print version
Usage Examples
- "Why is nginx running on this server?"
- "What process is using port 3000?"
- "Show me the ancestry chain for PID 1234"
- "What started this postgres process?"
- "Check if there's a process listening on port 8080"
Key Features
- Explains why a process exists, not just that it exists
- Traces: systemd, launchd, Docker, Podman, PM2, cron, tmux, SSH, and more
- Detects containers, git repos, working directory, environment variables
- Detects warnings: root process, public bindings, high memory, deleted binaries
- Cross-platform: Linux, macOS, Windows, FreeBSD
- JSON output for automation
1---2name: witr3description: Use this skill when the user needs to understand why a process, service, or port is running — tracing ancestry, supervisors, containers, and service managers.4---56# witr — Why Is This Running?78CLI tool that answers "Why is this running?" by tracing process ancestry chains, supervisor relationships (systemd, launchd, Docker, PM2, tmux, SSH), containers, and service managers.910## Installation1112```bash13brew install witr14```1516## Commands1718- `witr process explain <name>` — Explain why a process is running19- `witr process explain systemd-journald` — Explain a specific process20- `witr _ _ --exact <name>` — Exact name match (passthrough)21- `witr _ _ --pid <n>` — Explain by PID22- `witr _ _ --port <n>` — Explain what's on a port23- `witr _ _ --json <name>` — JSON output24- `witr self version` — Print version2526## Usage Examples2728- "Why is nginx running on this server?"29- "What process is using port 3000?"30- "Show me the ancestry chain for PID 1234"31- "What started this postgres process?"32- "Check if there's a process listening on port 8080"3334## Key Features3536- Explains why a process exists, not just that it exists37- Traces: systemd, launchd, Docker, Podman, PM2, cron, tmux, SSH, and more38- Detects containers, git repos, working directory, environment variables39- Detects warnings: root process, public bindings, high memory, deleted binaries40- Cross-platform: Linux, macOS, Windows, FreeBSD41- JSON output for automation
javimosch