witr (Why Is This Running) is an innovative tool designed to provide clear answers to the question: Why is this running? It goes beyond merely listing processes, services, or network connections on a system by elucidating the underlying reasons for their existence.

Purpose

When a process is active on a system—be it a service, service, or a process bound to a port—the reason it is running can often be indirect or complex, spanning multiple layers such as containers, supervisors, and shells. Traditional tools like ps, top, lsof, ss, systemctl, and docker ps merely provide information on what is running, leaving users to infer why, often resulting in confusion and time wasted in debugging.

witr simplifies this process by explicitly detailing:

• The origins of a running process
• The method of its initiation
• The systems responsible for its current state

Goals

Primary Goals

• Clarify why a process exists, not just that it exists
• Reduce the time required to comprehend processes during debugging and outages
• Operate with zero configuration
• Function as a read-only, non-destructive tool
• Prioritize clarity over exhaustive detail

Non-Goals

• Not intended as a monitoring tool
• Not a performance profiler
• Should not replace existing system management tools like systemd or Docker
• Not designed for process remediation or automatic fixes

Core Concept

witr approaches the task from the perspective of discovering process truths:

1. What is running?
2. How did it start?
3. What is maintaining its operation?
4. What context does it operate within?

Supported Queries

witr can analyze various input forms to provide PID-related insights:

• By Name (Process or Service)

witr node  
witr nginx  

• By PID

witr --pid 14233  

• By Port

witr --port 5000  

Output Features

The output from witr is crafted to be both informative and legible:

• Default displays designed to fit on a single screen
• Deterministic ordering for better understanding
• Narrative-style explanations
• Emphasizes clarity, with explicit indications of uncertainty when necessary

Output includes:

• The target of the query
• Details of the process including PID, user, command, and start time
• An explanation of why the process exists
• The primary source that initiated or supervises the process
• Contextual information such as the working directory and associated Git repository
• Non-blocking warnings about critical conditions

Example Outputs

witr allows for intricate queries and displays the relevant information clearly:

Name-based query:

witr node  

Returns:

Target      : node  
Process     : node (pid 14233)  
User        : pm2  
Command     : node index.js  
Started     : 2 days ago  
Restarts    : 1  
Why It Exists :  
systemd (pid 1) → pm2 (pid 5034) → node (pid 14233)  
Source      : pm2  
Working Dir : /opt/apps/expense-manager  
Git Repo    : expense-manager (main)  
Listening   : 127.0.0.1:5001

Conclusion

witr empowers users to understand the processes running within their systems, enabling faster troubleshooting and reduced reliance on multiple tools. This intuitive approach makes it a crucial addition to any engineer's toolkit, especially in high-stress situations where clarity and speed are essential.