# pranshuparmar/witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

Repository: https://github.com/pranshuparmar/witr
Canonical: https://ross.abutalabs.com/products/witr
Homepage: https://pranshuparmar.github.io/witr/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: cli, devops, freebsd, golang, linux, macos, observability, sysadmin, troubleshooting, tui, windows, containers, docker, incident-response, process-management, systemd, go, kubernetes, monitoring, terminal
Last push: 2026-08-15T22:55:12+00:00

## Health v2 (maintenance only)
Score: 79/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 97, release rhythm 90, longevity 18
- inputs: {"age_days": 256, "days_push": 18, "days_rel": 70, "gap_med": 1.5, "n_releases_24m": 21}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 21701, forks 756 (observed 2026-08-28T04:11:31.972208+00:00)

## What it is
witr is a CLI and TUI tool that traces any running process, port, container, or file back to the exact chain of systems that started it, answering 'why is this running?'. It outputs human-readable trees or machine-readable JSON and runs as a single static binary on Linux, macOS, Windows, and FreeBSD.

## Use cases
- find out why a process is running on my server
- trace which service started a port listener
- figure out what launched a container
- debug unexpected background processes during incident response
- trace a process back to its systemd unit or supervisor
- identify the parent chain of a runaway process
- see what started a node process managed by pm2

## When to choose
- you need to explain the origin of a process, port, or container beyond what ps/lsof/ss show
- you want one command with machine-readable JSON output for automation
- you work across Linux, macOS, Windows, or FreeBSD and need a single static binary
- you're doing incident response or sysadmin troubleshooting

## When to avoid
- you only need to list or monitor processes rather than trace their origin
- you need deep kernel-level tracing or eBPF-based observability
- you want a GUI-based system monitor

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, developer-tools, cli, terminal-ui
- domain: developer-tools, monitoring
- platform: windows, bsd, cli
- tags: process-tracing, troubleshooting, observability, incident-response, tui, systemd, go, devops, command-line, containers, linux, macos, docker, kubernetes

## Member repositories
- pranshuparmar/witr (main) score 79

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:31.972208+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:57:49.880228+00:00, confidence not recorded.
  - readme: https://github.com/pranshuparmar/witr (fetched 2026-08-28T04:11:31.972208+00:00, sha a916b47cad64)
  - homepage: https://pranshuparmar.github.io/witr/ (fetched 2026-08-29T07:56:19.365860+00:00, sha 7867a94532c2)
- Data as of 2026-08-30T08:39:29.467469+00:00.