Show HN: Witr – Explain why a process is running on your Linux system

4 months ago

witr is a tool designed to answer the question 'Why is this running?' by explaining the causality behind processes, services, or ports.
It provides a human-readable output showing how a process was started, its ancestry chain, and the primary system responsible for it.
witr supports multiple entry points like process names, PIDs, or ports, and converges to PID analysis.
Key features include zero configuration, read-only operation, clarity over completeness, and not being a monitoring or remediation tool.
It can explain processes, services, containers, and commands by mapping them to PIDs and building a causal chain.
witr offers various flags for customization, such as --short for one-line summaries, --tree for full ancestry trees, and --json for JSON output.
Installation is simple via a script or manual steps, supporting both amd64 and arm64 architectures.
witr requires Linux and may need elevated permissions (sudo) for detailed process information.
Success for witr is measured by quick understanding, reduced tool reliance, and trust during incidents.
The project was developed with AI/LLM assistance under human supervision.

Hasty Briefsbeta