6 ms·
Show HN: Witr – Explain why a process is running on your Linux system
Hi HN,
I built a small Linux CLI tool called witr (Why Is This Running?).
The idea came from a situation most of us have hit: you log into a machine, see a process or port running, and immediately wonder why it exists, who started it, and what is keeping it alive right now.
witr traces a process, service, or port back to its origin and responsibility chain and explains it in a way that’s quick to read, especially when you’re debugging under pressure.
This is v0.1.0. It’s intentionally small and focused.
Feedback, criticism, and edge cases are very welcome.
Repo: https://github.com/pranshuparmar/witr https://github.com/pranshuparmar/witr
- pranshuparmar 10mo agoA quick note on scope: this is not meant to replace existing monitoring or observability tools. It’s designed for those moments when you SSH into a box and need to quickly understand “why is this running” without digging through configs, cron jobs, or service trees manually. Happy to answer questions or adjust direction based on feedback.
- dcminter 10mo agoThis is very clever. I've often needed to figure out what some running process was actually for (e.g. because it just started consuming a lot of some limited resource) but it never occurred to me that one could have a tool to answer that question. Well done. --- Edit: Ah, ok, I slightly misunderstood - skimmed the README too quickly. I thought it was also explaining what the process did :D Still a clever tool, but thought it went a step further. Perhaps you should add that though - combine Man page output with a database of known processes that run on various Linux systems and a mechanism for contributing PRs to extend that database...? Unlesss it's just me that often wants to know "what the fsck does /tmp/hax0r/deeploysketchyd actually do?" :P
- filterfish 10mo agoLooking up the binary in the package management system would also provide another source of useful information. Of course this would dramatically increase the complexity but would, I think, be useful. If you could look it up using APT/dpkg first, that would be lovely :-)
- ajb 10mo agoIf you have its path, dpkg already has an option to do that: "dpkg -S". Although some extra logic is needed for symlinks.
- darrenf 10mo agoIs that not `whatis`? https://www.man7.org/linux/man-pages/man1/whatis.1.html https://www.man7.org/linux/man-pages/man1/whatis.1.html
- pranshuparmar 10mo agoThanks, glad you liked it! As @darrenf mentioned, `whatis` can help with that use case. For now, I’m keeping `witr` focused on explaining PIDs.
- scrame 10mo agoI left a different comment, but I think this is good. You're example is 3306 and has a useful breakdown. Not everyone has that port memorized by trauma, and not every mysql instance uses that port. New tools are always welcome, and having a purpose to explain a purpose seems like a good pitch.
- pranshuparmar 10mo agoTotally. Just to clarify, witr isn’t limited to ports. You can run it directly on a process too, like `witr mysql`. I used the 3306 example to emphasize this use case.
- Saris 10mo agoThis looks very handy to have around!
- pranshuparmar 10mo agoThank you.
- canxerian 10mo agoGreat idea!
- pranshuparmar 10mo agoThank you.
- 4ggr0 10mo agoi definitely see the use for it, lots of moments where i wonder how or why something was started.
- pranshuparmar 10mo agoThank you, please feel free to share any feedback/ideas.
- q2dg 10mo agopstree doesn't answer the why?
- mathfailure 10mo agoNo, it does not.
- tatref 10mo agoI'm on mobile, so it's not super easy to read the source, but it seems like it only checks for the parent processes? Also I don't think this approach works correctly, because a disowned/nohup process will show up as PPID 1 (systemd), which is not correct
- pranshuparmar 10mo agoYes, this is a bug. Planning to fix it soon.
- dontdieych 10mo agoNice and installed then starred.
- pranshuparmar 10mo agoThank you, please feel free to share any feedback/ideas.
- fooqux 10mo agoThis is amazing. Thank you for sharing this. Do you have any qualms about me making an entry in the AUR for this?
- giancarlostoro 10mo agoIm not the author but I would love for an AUR made for this ;) My favorite thing about arch is how insanely quickly AURs pop up for interesting tools.
- deleted 10mo ago[deleted]
- pranshuparmar 10mo agoThanks! Really appreciate it. No qualms at all — an AUR entry would be awesome!
- pranshuparmar 10mo agoNot sure if you're the one who created it but the AUR for this is present and needs update for the latest version - https://aur.archlinux.org/packages/witr-bin https://aur.archlinux.org/packages/witr-bin
- fooqux 10mo agoNo, wasn't me. Was planning on taking care of it after the holidays were finished. Someone beat me to it!
- techsystems 10mo agoI'm really loving this! 'Responsibility chain' will become a trendy phrase.
- pranshuparmar 10mo agoHaha, glad you like it! Maybe "responsibility chain" will catch on.
- mh- 10mo agoThis is great. Small, trivial suggestion: the gif that loops in the README should pause on the screen w/ the output for a few seconds longer - it disappears (restarts) too quickly to take in all of the output.
- stavros 10mo agohttps://github.com/charmbracelet/vhs https://github.com/charmbracelet/vhs is a really good utility for automatically making these gifs.
- sestep 10mo agoI'm a big fan of svg-term myself: https://github.com/marionebl/svg-term-cli https://github.com/marionebl/svg-term-cli
- stavros 10mo agoHm, very interesting! This only converts asciinema recordings, though, right? It doesn't automatically record anything?
- sestep 10mo agoIf you have asciinema already installed then you can invoke it through svg-term like this! svg-term --command 'cowsay hey there' But that has the aforementioned issues about not pausing enough, so I usually just record with asciinema first and then invoke svg-term.
- Neywiny 10mo agoI would also argue it shouldn't be a gif. It's nice that it shows the command is fast I guess but it's one command that's still visible in the final frame. Not as bandwidth efficient and agreed I can't read it all in time
- rzzzt 10mo agoAlso the pause button seems to take the GIF back to its first frame, then resume from where I paused... either that or I need a good sleep.
- DougN7 10mo agoWhat does this means for context: “Git repository name and branch” Does this mean it detects if something is running from within a git repository folder? Couldn’t find the code that checked this.
- jackwilsdon 10mo agoIt appears to walk up from the process's working directory searching for a .git directory: https://github.com/pranshuparmar/witr/blob/1e47bdb8fde179b178aa2f81bf6502c5cd8be094/internal/linux/proc/process.go#L74-L90 https://github.com/pranshuparmar/witr/blob/1e47bdb8fde179b17...
- pranshuparmar 10mo agoYes, that's correct! It walks up from the process’s working directory looking for a `.git` folder to detect the repo and branch. Thanks.
- be_erik 10mo agoIf you're looking to build and install this from source, here's the incantation: CGO_ENABLED=0 go build -ldflags "-X main.version=dev -X main.commit=$(git rev-parse --short HEAD) -X 'main.buildDate=$(date +%Y-%m-%d)'" -o witr ./cmd/witr Call me old-fashioned, but if there's an install.sh, I would hope it would prefer the local src over binaries. Very cool utility! Simple tools like these keep me glued to the terminal. Thank you!
- sestep 10mo agoAlternatively you can use Nix! :P https://github.com/pranshuparmar/witr/pull/5 https://github.com/pranshuparmar/witr/pull/5
- pranshuparmar 10mo agoThanks! Glad you like it Thanks to @sestep, Nix support is already added, so no need to worry about binaries.
- wyldfire 10mo ago`ps uaxf` gives me pretty similar output.
- pranshuparmar 10mo ago`witr` is trying to be a bit different. Here are few use cases to consider: - When a process started. - Which ports a process is using. - Which user started it. - From which directory it started. - env flag to list all the variables attached to the process. - json flag to use it programmatically.
- properbrew 10mo agoThis is extremely useful, will be added to the toolbox. Thanks for sharing.
- pranshuparmar 10mo agoThank you, please feel free to share any feedback/ideas.
- vzaliva 10mo agoSounds like something I could use, but installing a binary via `curl` doesn't sit right with me. Next problem you have is "explain how this thing was installed on my system" followed "is it up to date (including security patches). I hope they have deb package or snap some day.
- fouc 10mo agonew utility command coming soon! wdtci - "what does this curl install?"
- klooney 10mo ago`systemctl status $pid` will get you a lot
- pranshuparmar 10mo agoI understand that installing via `curl` isn’t for everyone, but since this is the first release, I intentionally kept it simple. Now that the tool is gaining some traction, I can definitely plan proper packages for future releases. Thanks for your inputs.
- jamescun 10mo agoHave a look at https://goreleaser.com/ https://goreleaser.com/ , I've used it a bunch to automate releases of Go-based projects, locally and with GitHub Actions.
- 9mo ago
- pcdoodle 10mo ago[dead]
- fracus 10mo agoI really like this. Something like this should already exist, stock.
- pranshuparmar 10mo agoThanks! Funny enough, that was my thought too when creating it.
- zenoprax 10mo ago> witr is successful if users trust it during incidents. > This project was developed with assistance from AI/LLMs [...] supervised by a human who occasionally knew what he was doing. This seems contradictory to me.
- zephyreon 10mo agoThe last bit > supervised by a human who occasionally knew what he was doing. seems in jest but I could be wrong. If omitted or flagged as actual sarcasm I would feel a lot better about the project overall. As long as you’re auditing the LLM’s outputs and doing a decent code review I think it’s reasonable to trust this tool during incidents. I’ll admit I did go straight to the end of the readme to look for this exact statement. I appreciate they chose to disclose.
- otabdeveloper4 10mo agoIf you're capable of auditing the LLM’s outputs and doing a decent code review then you don't need an LLM.
- Retr0id 10mo agoNobody who was writing code before LLMs existed "needs" an LLM, but they can still be handy. Procfs parsing trivialities are the kind of thing LLMs are good at, although apparently it still takes a human to say "why not using an existing library that solves this, like https://pkg.go.dev/github.com/prometheus/procfs https://pkg.go.dev/github.com/prometheus/procfs"
- otabdeveloper4 10mo ago> Procfs parsing trivialities are the kind of thing LLMs are good at Have you tried it? Procfs trivialities is exactly the kind of thing where an LLM will hallucinate something plausible-looking. Fixing LLM hallucinations takes more work and time than just reading manpages and writing code yourself.
- tototrains 10mo agoWorth mentioning: I had claude code find a crypto miner on an infected system which had been running for ~5 months undetected. Up-to-date windows 10 machine. Single prompt saying "This PC is using too much power or fans, investigate". Took minutes, completely cleaned up the infection (I hope) and identified its source. Fantastic use-case.
- jbnorth 10mo agoYou’re better off wiping and reinstalling the OS than trying to clean the system.
- da_grift_shift 10mo ago>I hope
- epiccoleman 10mo agoCool idea. Reminds me of my alias "whodis" which just lsofs a port to find out the pid who's got it open, but way more functional.
- pranshuparmar 10mo agoThanks! Glad you like it Trying to make this a swiss army knife for PID information.
- cedsam 10mo agoThis is amazing and really useful to me. Great job. However, I can’t use it in a production business environment for the same reasons other users mentioned earlier. A Debian or RPM package would be fantastic.
- pranshuparmar 10mo agoThank you, glad you liked it. Since this is the first release, I intentionally kept it simple. Now that the tool is gaining some traction, I can definitely plan proper packages for future releases. Thanks for your inputs.
- jsomedon 10mo agoBrilliant stuff! Any plan to support macos?
- pranshuparmar 10mo agoThank you, yes coming soon - https://github.com/pranshuparmar/witr/pull/9 https://github.com/pranshuparmar/witr/pull/9
- saidnooneever 10mo agoseems handy but mostly the ppid is outputted as the reason for starting. its 'who dun it', not really _why_ it was started. (service file, autorun, execve etc.) i see you support multiple output format including json thats nice. id recommend to assume automation (ssh script/commands) and make the default output really easily greppable , or json (jq) since itll be more appealing to parse (shouldnt reduce readability, for the default output it looks like just removing some linebreaks to make it parse more consistently. (maybe the lines are wrapped tho? unclear from the img)
- pranshuparmar 10mo agoThanks for the feedback! I’ll look into showing who and why in a more distinct way. The default output is human-first, hence some extra line breaks, but the JSON flag is already there for automation. We can also see if it can be made more easily greppable.
- ManuelKiessling 10mo agoI‘m SO going to steal your AI Assistance Disclaimer.
- pranshuparmar 10mo agoHaha, go for it!
- dxdm 10mo agoVery nice README, too.
- scrame 10mo agoThis is great. One of those things that just formats and does all the little niggling things you have to do sometimes. I like that it is simple, and doesn't (thank god) need npm or some other package manager. to quote the top comment: just show a screenshot of its results, if its useful its fine, being fast is just gravy.
- gavinray 10mo agoThe "htop" utility has a "Tree View" if you press F5 that is pretty handy for this, too.
- tacone 10mo ago> This project was developed with assistance from AI/LLMs (including GitHub Copilot, ChatGPT, and related tools), supervised by a human who occasionally knew what he was doing. That's the good part of AI. Lowers effort and knowledge barrier and makes things possible.
- xk3 10mo agoNote that you can do a lot of this by just querying systemctl with the PID systemctl status 1 And there might be more than one process using a port sudo lsof +c 0 -i:22
- pranshuparmar 10mo agoQuick update, witr now supports macOS as well. You can install it using brew - https://github.com/pranshuparmar/witr?tab=readme-ov-file#81-homebrew-macos--linux https://github.com/pranshuparmar/witr?tab=readme-ov-file#81-...
- Sayyidalijufri 10mo agoGood job BTW any chance you would make MacOS version of this?
- pranshuparmar 9mo agoThank you, mac is already supported, only with the very first release it wasn't. You can install it via brew.
- Sayyidalijufri 9mo agoThanks Good job
- _mig5 10mo agoGreat tool! I was looking to convert my decades-old shell script into something a bit more modern and user-friendly, and lo and behold, this appeared right at the same time :) I'll just use yours instead. Well done! :)
- pranshuparmar 9mo agoQuick update: witr now supports Linux, macOS, Windows, and FreeBSD.