NAME¶

witr - Why is this running?

SYNOPSIS¶

witr [process name...] [flags]

DESCRIPTION¶

witr explains why a process or port is running by tracing its ancestry.

OPTIONS¶

--env[=false] show environment variables for the process

-x, --exact[=false] use exact name matching (no substring search)

-f, --file=[] file path(s) to find process for (repeatable)

-h, --help[=false] help for witr

-i, --interactive[=false] interactive mode (TUI)

--json[=false] show result as JSON

--no-color[=false] disable colorized output

-p, --pid=[] pid(s) to look up (repeatable)

-o, --port=[] port(s) to look up (repeatable)

-s, --short[=false] show only ancestry

-t, --tree[=false] show only ancestry as a tree

--verbose[=false] show extended process information

--warnings[=false] show only warnings

EXAMPLE¶

  # Inspect a running process by name


  witr nginx


  # Look up a process by PID


  witr --pid 1234


  # Find the process listening on a specific port


  witr --port 5432


  # Find the process holding a lock on a file


  witr --file /var/lib/dpkg/lock


  # Inspect a process by name with exact matching (no fuzzy search)


  witr bun --exact


  # Show the full process ancestry (who started whom)


  witr postgres --tree


  # Show only warnings (suspicious env, arguments, parents)


  witr docker --warnings


  # Display only environment variables of the process


  witr node --env


  # Short, single-line output (useful for scripts)


  witr sshd --short


  # Disable colorized output (CI or piping)


  witr redis --no-color


  # Output machine-readable JSON


  witr chrome --json


  # Show extended process information (memory, I/O, file descriptors)


  witr mysql --verbose


  # Combine flags: inspect port, show environment variables, output JSON


  witr --port 8080 --env --json


  # Multiple inputs


  witr nginx node


  witr --port 8080 --port 3000


  witr --pid 1234 --pid 5678


  # Mixed inputs


  witr nginx --pid 1234 --port 8080