# witr

> Traces a process, port, container, or file back to the chain of supervisors, services, and shells that started it. Offers CLI, JSON output, and a TUI.

Stars: 22.8k · Language: Go · License: Apache-2.0 · Categories: System

- Repository: https://github.com/pranshuparmar/witr
- Website: https://pranshuparmar.github.io/witr/
- Page: https://www.trmn.sh/tools/witr

## Install

- Homebrew: `brew install witr`
- APT: `sudo apt install witr`
- Install script (Unix): `curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash`

## Overview

witr answers the question "why is this running?" for a process, service, port, container, or file. Tools such as ps, top, lsof, ss, systemctl, and docker ps show what is running and its metadata, but the user has to correlate their outputs to work out the cause. witr does that correlation and prints the causal chain, for example systemd → PM2 → node, in a single output.

It can be used as a one-shot command that prints human-readable output, as a command that emits machine-readable JSON, or as an interactive TUI dashboard. The CLI and TUI show the same ancestry chain. The README also links a browser-based sandbox with a simulated Linux box, including a guided tutorial, so the tool can be tried without installing it.

witr is distributed as a single static binary for Linux, macOS, FreeBSD, and Windows, for amd64 and arm64 on Unix. It is packaged for many ecosystems, including apt, Homebrew, MacPorts, Conda, AUR, Winget, Chocolatey, Scoop, npm, and FreeBSD Ports. Its users are developers, sysadmins, and SREs who need to find out what started an unexpected process or what is holding a port.

### Installation

```bash
# via Homebrew
brew install witr
```

```bash
# via APT
sudo apt install witr
```

```bash
# via Install script (Unix)
curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash
```

![witr TUI and CLI showing why a node process is running](https://media.trmn.sh/cached/6b9b98fe66e8d6f9b8a7d8be55f8ff4d970984441cdabc9fc632d05848f227f0.png)

## Alternatives

- [age](https://www.trmn.sh/tools/age.md): File encryption tool with small explicit keys, post-quantum support, and UNIX-style composability. (Go, 24.1k stars)
- [ctop](https://www.trmn.sh/tools/ctop.md): Top-like interface for monitoring Docker and runC container metrics in real-time (Go, 17.8k stars)
- [duf](https://www.trmn.sh/tools/duf.md): Disk usage utility with colorful output, filtering, and JSON export - replacement for df command (Go, 15.4k stars)
- [Kopia](https://www.trmn.sh/tools/kopia.md): Cross-platform backup tool that creates encrypted, compressed, deduplicated snapshots and stores them on cloud, network, or local storage. Includes CLI and GUI. (Go, 14.5k stars)
- [restic](https://www.trmn.sh/tools/restic.md): Cross-platform backup program with encryption, deduplication, and support for local/cloud storage backends (Go, 36.9k stars)

---

Canonical: https://www.trmn.sh/tools/witr