NAME¶

witr - Why is this running?

SYNOPSIS¶

witr [process name] [flags]

DESCRIPTION¶

witr explains why a process or port is running by tracing its ancestry.

OPTIONS¶

--env[=false] show environment variables for the process

-h, --help[=false] help for witr

--json[=false] show result as JSON

--no-color[=false] disable colorized output

--pid="" pid to look up

--port="" port to look up

--short[=false] show only ancestry

--tree[=false] show only ancestry as a tree

--verbose[=false] show extended process information

--warnings[=false] show only warnings

EXAMPLE¶

  # Inspect a running process by name


  witr nginx


  # Look up a process by PID


  witr --pid 1234


  # Find the process listening on a specific port


  witr --port 5432


  # Show the full process ancestry (who started whom)


  witr postgres --tree


  # Show only warnings (suspicious env, arguments, parents)


  witr docker --warnings


  # Display only environment variables of the process


  witr node --env


  # Short, single-line output (useful for scripts)


  witr sshd --short


  # Disable colorized output (CI or piping)


  witr redis --no-color


  # Output machine-readable JSON


  witr chrome --json


  # Show extended process information (memory, I/O, file descriptors)


  witr mysql --verbose


  # Combine flags: inspect port, show environment variables, output JSON


  witr --port 8080 --env --json