Trace the origin of running processes and ports
When an unwanted process is running on a server or a port is blocked, you can immediately see what started it. witr is a tool that follows the path of a specified process, port, container, or file to find the cause. It helps you understand complex system execution flows at a glance, reducing incident response time.
How it traces execution
Existing tools only show the current running state without directly connecting the causal relationship of why a process is running. witr traces the execution chain by working backward from the process ID to the parent process, service, and container runtime. This allows you to clearly identify whether a systemd unit, Docker container, or shell script started the process. The output is provided as human-readable text, JSON for scripts, or an interactive TUI.
Various targets and output methods
witr can search by various criteria, including process name, port number, PID, file path, and container name.
- Interactive TUI Explore processes, ports, containers, and file locks in real time and send signals from a terminal-based dashboard.
- AI agent integration Provides JSON output and clear exit codes to help AI coding agents automatically diagnose port conflicts or process issues.
- Warning system Automatically detects and alerts on potential risks, such as processes listening on public interfaces or running with root privileges.
Installation and platform support
witr is distributed as a single static binary written in Go and runs on Linux, macOS, FreeBSD, and Windows.
- Quick installation Download the latest binary and add it to your PATH with a single curl or PowerShell command.
- Package managers Supports package managers from various ecosystems, including Homebrew, Conda, Winget, npm, and apt.
- Source build Build directly from source via Go modules to use the latest features.
Pre-use considerations
witr requires appropriate permissions to read system process information. Some processes or ports are inaccessible without root privileges, in which case it returns exit code 3. On Windows, cause tracing is often impossible, so exit code 6 is not used. TUI mode requires a terminal environment, and you must specify a target flag when running in scripts or CI pipelines. If installed via a package manager, the version may not be the latest depending on the manager's update cycle; the installation script is recommended if you need the newest features.
