witr

witr is a command line diagnostic tool that explains why a process is running, not only that it exists. It can start from a process or service name, a PID, or a listening port, then resolves that target to the relevant process and builds a causal ancestry chain that shows how the process started and what is keeping it alive.

Its output is organized into sections such as target, process details, “why it exists” ancestry, the primary source responsible for starting or supervising the process (for example systemd, launchd, Windows Services, Docker, pm2, cron, or an interactive shell), plus best effort context like working directory, Git repository and branch, container name and image, and bind scope. It also supports optional warnings for common risk and health signals, and includes flags for JSON output, tree or short ancestry views, environment variable display, and color control.

witr supports Linux, macOS, Windows, and FreeBSD, using platform specific tooling to inspect processes and networking. The project is open source and released under the Apache 2.0 license.