Show HN: Witr – Explain why a process is running on your Linux system

526•pranshuparmar•1mo ago

Hi HN,

I built a small Linux CLI tool called witr (Why Is This Running?).

The idea came from a situation most of us have hit: you log into a machine, see a process or port running, and immediately wonder why it exists, who started it, and what is keeping it alive right now.

witr traces a process, service, or port back to its origin and responsibility chain and explains it in a way that’s quick to read, especially when you’re debugging under pressure.

This is v0.1.0. It’s intentionally small and focused. Feedback, criticism, and edge cases are very welcome.

Repo: https://github.com/pranshuparmar/witr

Comments

pranshuparmar•1mo ago

A quick note on scope: this is not meant to replace existing monitoring or observability tools. It’s designed for those moments when you SSH into a box and need to quickly understand “why is this running” without digging through configs, cron jobs, or service trees manually.

Happy to answer questions or adjust direction based on feedback.

dcminter•1mo ago

This is very clever. I've often needed to figure out what some running process was actually for (e.g. because it just started consuming a lot of some limited resource) but it never occurred to me that one could have a tool to answer that question. Well done.

---

Edit: Ah, ok, I slightly misunderstood - skimmed the README too quickly. I thought it was also explaining what the process did :D Still a clever tool, but thought it went a step further.

Perhaps you should add that though - combine Man page output with a database of known processes that run on various Linux systems and a mechanism for contributing PRs to extend that database...? Unlesss it's just me that often wants to know "what the fsck does /tmp/hax0r/deeploysketchyd actually do?" :P

filterfish•1mo ago

Looking up the binary in the package management system would also provide another source of useful information. Of course this would dramatically increase the complexity but would, I think, be useful.

If you could look it up using APT/dpkg first, that would be lovely :-)

ajb•1mo ago

If you have its path, dpkg already has an option to do that: "dpkg -S". Although some extra logic is needed for symlinks.

darrenf•1mo ago

Is that not `whatis`?

https://www.man7.org/linux/man-pages/man1/whatis.1.html

pranshuparmar•1mo ago

Thanks, glad you liked it! As @darrenf mentioned, `whatis` can help with that use case. For now, I’m keeping `witr` focused on explaining PIDs.

scrame•1mo ago

I left a different comment, but I think this is good. You're example is 3306 and has a useful breakdown. Not everyone has that port memorized by trauma, and not every mysql instance uses that port.

New tools are always welcome, and having a purpose to explain a purpose seems like a good pitch.

pranshuparmar•1mo ago

Totally. Just to clarify, witr isn’t limited to ports. You can run it directly on a process too, like `witr mysql`. I used the 3306 example to emphasize this use case.

Saris•1mo ago

This looks very handy to have around!

pranshuparmar•1mo ago

Thank you.

canxerian•1mo ago

Great idea!

pranshuparmar•1mo ago

Thank you.

4ggr0•1mo ago

i definitely see the use for it, lots of moments where i wonder how or why something was started.

pranshuparmar•1mo ago

Thank you, please feel free to share any feedback/ideas.

q2dg•1mo ago

pstree doesn't answer the why?

mathfailure•1mo ago

No, it does not.

tatref•1mo ago

I'm on mobile, so it's not super easy to read the source, but it seems like it only checks for the parent processes?

Also I don't think this approach works correctly, because a disowned/nohup process will show up as PPID 1 (systemd), which is not correct

pranshuparmar•1mo ago

Yes, this is a bug. Planning to fix it soon.

dontdieych•1mo ago

Nice and installed then starred.

pranshuparmar•1mo ago

Thank you, please feel free to share any feedback/ideas.

TheCraiggers•1mo ago

This is amazing. Thank you for sharing this.

Do you have any qualms about me making an entry in the AUR for this?

giancarlostoro•1mo ago

Im not the author but I would love for an AUR made for this ;)

My favorite thing about arch is how insanely quickly AURs pop up for interesting tools.

pranshuparmar•1mo ago

Thanks! Really appreciate it. No qualms at all — an AUR entry would be awesome!

pranshuparmar•1mo ago

Not sure if you're the one who created it but the AUR for this is present and needs update for the latest version - https://aur.archlinux.org/packages/witr-bin

TheCraiggers•1mo ago

No, wasn't me. Was planning on taking care of it after the holidays were finished. Someone beat me to it!

techsystems•1mo ago

I'm really loving this!

'Responsibility chain' will become a trendy phrase.

pranshuparmar•1mo ago

Haha, glad you like it! Maybe "responsibility chain" will catch on.

mh-•1mo ago

This is great. Small, trivial suggestion: the gif that loops in the README should pause on the screen w/ the output for a few seconds longer - it disappears (restarts) too quickly to take in all of the output.

stavros•1mo ago

https://github.com/charmbracelet/vhs is a really good utility for automatically making these gifs.

sestep•1mo ago

I'm a big fan of svg-term myself: https://github.com/marionebl/svg-term-cli

stavros•1mo ago

Hm, very interesting! This only converts asciinema recordings, though, right? It doesn't automatically record anything?

sestep•1mo ago

If you have asciinema already installed then you can invoke it through svg-term like this!

  svg-term --command 'cowsay hey there'

But that has the aforementioned issues about not pausing enough, so I usually just record with asciinema first and then invoke svg-term.

Neywiny•1mo ago

I would also argue it shouldn't be a gif. It's nice that it shows the command is fast I guess but it's one command that's still visible in the final frame. Not as bandwidth efficient and agreed I can't read it all in time

rzzzt•1mo ago

Also the pause button seems to take the GIF back to its first frame, then resume from where I paused... either that or I need a good sleep.

godelski•1mo ago

  > the gif that loops in the README should pause on the screen

Honestly, I think a screenshot is better than a gif. That last frame says everything you need.

thaumasiotes•1mo ago

You can make that problem irrelevant with the much, much simpler solution of not animating it at all. Stay paused on the output 100% of the time!

The gif is adding no value. I already know what typing text into a terminal looks like.

pranshuparmar•1mo ago

Thanks everyone for the feedback on the GIF! I though it looked good but when I went back to see it from a user's POV, it was really miserable, haha. I've already switched it to a static image, appreaciate everyone's input and suggestions.

DougN7•1mo ago

What does this means for context: “Git repository name and branch” Does this mean it detects if something is running from within a git repository folder? Couldn’t find the code that checked this.

jackwilsdon•1mo ago

It appears to walk up from the process's working directory searching for a .git directory: https://github.com/pranshuparmar/witr/blob/1e47bdb8fde179b17...

pranshuparmar•1mo ago

Yes, that's correct! It walks up from the process’s working directory looking for a `.git` folder to detect the repo and branch. Thanks.

be_erik•1mo ago

If you're looking to build and install this from source, here's the incantation:

CGO_ENABLED=0 go build -ldflags "-X main.version=dev -X main.commit=$(git rev-parse --short HEAD) -X 'main.buildDate=$(date +%Y-%m-%d)'" -o witr ./cmd/witr

Call me old-fashioned, but if there's an install.sh, I would hope it would prefer the local src over binaries.

Very cool utility! Simple tools like these keep me glued to the terminal. Thank you!

sestep•1mo ago

Alternatively you can use Nix! :P https://github.com/pranshuparmar/witr/pull/5

pranshuparmar•1mo ago

Thanks! Glad you like it Thanks to @sestep, Nix support is already added, so no need to worry about binaries.

wyldfire•1mo ago

`ps uaxf` gives me pretty similar output.

pranshuparmar•1mo ago

`witr` is trying to be a bit different. Here are few use cases to consider: - When a process started. - Which ports a process is using. - Which user started it. - From which directory it started. - env flag to list all the variables attached to the process. - json flag to use it programmatically.

properbrew•1mo ago

This is extremely useful, will be added to the toolbox. Thanks for sharing.

pranshuparmar•1mo ago

Thank you, please feel free to share any feedback/ideas.

vzaliva•1mo ago

Sounds like something I could use, but installing a binary via `curl` doesn't sit right with me. Next problem you have is "explain how this thing was installed on my system" followed "is it up to date (including security patches).

I hope they have deb package or snap some day.

fouc•1mo ago

new utility command coming soon! wdtci - "what does this curl install?"

fph•1mo ago

Depends on dtps - "does this program stop".

Msurrow•1mo ago

Depends on environment variable P=NP

klooney•1mo ago

`systemctl status $pid` will get you a lot

pranshuparmar•1mo ago

I understand that installing via `curl` isn’t for everyone, but since this is the first release, I intentionally kept it simple. Now that the tool is gaining some traction, I can definitely plan proper packages for future releases. Thanks for your inputs.

jamescun•1mo ago

Have a look at https://goreleaser.com/ , I've used it a bunch to automate releases of Go-based projects, locally and with GitHub Actions.

pranshuparmar•1mo ago

Thanks a lot for the input, I ended up using it.

pranshuparmar•1mo ago

Just to update, witr is currently available on brew and AUR. deb, rpm and apk packages are also available in the release, and can be run directly via nix without installation.

fracus•1mo ago

I really like this. Something like this should already exist, stock.

pranshuparmar•1mo ago

Thanks! Funny enough, that was my thought too when creating it.

zenoprax•1mo ago

> witr is successful if users trust it during incidents.

> This project was developed with assistance from AI/LLMs [...] supervised by a human who occasionally knew what he was doing.

This seems contradictory to me.

zephyreon•1mo ago

The last bit

> supervised by a human who occasionally knew what he was doing.

seems in jest but I could be wrong. If omitted or flagged as actual sarcasm I would feel a lot better about the project overall. As long as you’re auditing the LLM’s outputs and doing a decent code review I think it’s reasonable to trust this tool during incidents.

I’ll admit I did go straight to the end of the readme to look for this exact statement. I appreciate they chose to disclose.

otabdeveloper4•1mo ago

If you're capable of auditing the LLM’s outputs and doing a decent code review then you don't need an LLM.

Retr0id•1mo ago

Nobody who was writing code before LLMs existed "needs" an LLM, but they can still be handy. Procfs parsing trivialities are the kind of thing LLMs are good at, although apparently it still takes a human to say "why not using an existing library that solves this, like https://pkg.go.dev/github.com/prometheus/procfs"

otabdeveloper4•1mo ago

> Procfs parsing trivialities are the kind of thing LLMs are good at

Have you tried it? Procfs trivialities is exactly the kind of thing where an LLM will hallucinate something plausible-looking.

Fixing LLM hallucinations takes more work and time than just reading manpages and writing code yourself.

Retr0id•1mo ago

Claude code can read manpages too

delusional•1mo ago

It cant "read" anything. It can include the man page in the prompt, but it can never "read" it.

Retr0id•1mo ago

If the output is working code I don't really care whether it's reading, "reading", or """reading"""

otabdeveloper4•1mo ago

If I'd ever feel the urge to misengineer a rube goldberg contraption to manage my vibe coder LLM output I'll get back to you.

But at the moment I feel like all that sounds suspiciously like actual work.

Jach•1mo ago

Sometimes LLMs will give a "why not..." or just mention something related, that's how I found out about https://recoll.org/ and https://www.ventoy.net/ But people should probably more often explicitly prompt them to suggest alternatives before diving in to produce something new...

littlestymaar•1mo ago

Neither do you need and IDE, syntax highlighting or third party libraries, yet you use all of them.

There's nothing wrong for a software engineer about using LLMs as an additional tool in his toolbox. The problem arises when people stops doing software engineering because they believe the LLM is doing the engineering for them.

otabdeveloper4•1mo ago

I don't use IDEs that require more time and effort investment than they save.

You mileage may vary, though. Lots of software engineers love those time and effort tarpits.

littlestymaar•1mo ago

I don't know what “tarpit” you're talking about.

Every IDE I've used just worked out of the box, be it Visual Studio, Eclipse, or anything using the language server protocol.

Having the ability to have things like method auto-completion, go-to-definition and symbol renaming is a net productivity gain from the minute you start using it and I couldn't imagine this being a controversial take in 2025…

otabdeveloper4•1mo ago

> I don't know what “tarpit” you're talking about.

Really? You don't know software developers that would rather futz around with editor configs and tooling and libraries and etc, etc, all day every day instead of actually shipping the boring code?

You must be working in a different industry.

saidnooneever•1mo ago

need and can use are different things.

RickyLahey•1mo ago

right, we don't need a lot of things, yet here we are

pranshuparmar•1mo ago

Thank you, yes I added it in jest and still keeping it for sometime. It was always meant to be removed in future.

guywithahat•1mo ago

I agree, the LLM probably has a much better idea of what's happening than any human

solarkraft•1mo ago

No to me. It just has to demonstrate to work well, which is plenty possible with a developer focused on outcome rather than process (though hopefully they cared a bit about process/architecture too).

Retr0id•1mo ago

Regardless of code correctness, it's easy enough for malware to spoof process relationships.

pranshuparmar•1mo ago

Fair enough! That line was meant tongue‑in‑cheek, and to be transparent about LLM usage. Rest assured, they were assistants, not authorities.

gus_•1mo ago

I'd not trust any app that parses /proc to obtain process information (for reasons [0]), specially if the machine has been compromised (unless by "incident", the author means another thing):

https://github.com/pranshuparmar/witr/tree/main/internal/lin...

It should be the last option.

[0] https://news.ycombinator.com/item?id=46364057

dbmnt•1mo ago

I’m struggling with the utility of this logic. The argument seems to be "because malware can intercept /proc output, any tool relying on it is inherently unreliable."

While that’s theoretically true in a security context, it feels like a 'perfect is the enemy of the good' situation. Unless the author is discussing high-stakes incident response on a compromised system, discarding /proc-based tools for debugging and troubleshooting seems like throwing the baby out with the bathwater. If your environment is so compromised that /proc is lying to you, you've likely moved past standard tooling anyway.

tototrains•1mo ago

Worth mentioning: I had claude code find a crypto miner on an infected system which had been running for ~5 months undetected. Up-to-date windows 10 machine. Single prompt saying "This PC is using too much power or fans, investigate". Took minutes, completely cleaned up the infection (I hope) and identified its source. Fantastic use-case.

jbnorth•1mo ago

You’re better off wiping and reinstalling the OS than trying to clean the system.

da_grift_shift•1mo ago

>I hope

epiccoleman•1mo ago

Cool idea. Reminds me of my alias "whodis" which just lsofs a port to find out the pid who's got it open, but way more functional.

pranshuparmar•1mo ago

Thanks! Glad you like it Trying to make this a swiss army knife for PID information.

cedsam•1mo ago

This is amazing and really useful to me. Great job.

However, I can’t use it in a production business environment for the same reasons other users mentioned earlier. A Debian or RPM package would be fantastic.

pranshuparmar•1mo ago

Thank you, glad you liked it. Since this is the first release, I intentionally kept it simple. Now that the tool is gaining some traction, I can definitely plan proper packages for future releases. Thanks for your inputs.

jsomedon•1mo ago

Brilliant stuff! Any plan to support macos?

pranshuparmar•1mo ago

Thank you, yes coming soon - https://github.com/pranshuparmar/witr/pull/9

saidnooneever•1mo ago

seems handy but mostly the ppid is outputted as the reason for starting. its 'who dun it', not really _why_ it was started. (service file, autorun, execve etc.)

i see you support multiple output format including json thats nice. id recommend to assume automation (ssh script/commands) and make the default output really easily greppable , or json (jq) since itll be more appealing to parse (shouldnt reduce readability, for the default output it looks like just removing some linebreaks to make it parse more consistently. (maybe the lines are wrapped tho? unclear from the img)

pranshuparmar•1mo ago

Thanks for the feedback! I’ll look into showing who and why in a more distinct way. The default output is human-first, hence some extra line breaks, but the JSON flag is already there for automation. We can also see if it can be made more easily greppable.

ManuelKiessling•1mo ago

I‘m SO going to steal your AI Assistance Disclaimer.

pranshuparmar•1mo ago

Haha, go for it!

dxdm•1mo ago

Very nice README, too.

scrame•1mo ago

This is great. One of those things that just formats and does all the little niggling things you have to do sometimes. I like that it is simple, and doesn't (thank god) need npm or some other package manager.

to quote the top comment: just show a screenshot of its results, if its useful its fine, being fast is just gravy.

gavinray•1mo ago

The "htop" utility has a "Tree View" if you press F5 that is pretty handy for this, too.

tacone•1mo ago

> This project was developed with assistance from AI/LLMs (including GitHub Copilot, ChatGPT, and related tools), supervised by a human who occasionally knew what he was doing.

That's the good part of AI. Lowers effort and knowledge barrier and makes things possible.

xk3•1mo ago

Note that you can do a lot of this by just querying systemctl with the PID

    systemctl status 1

And there might be more than one process using a port

    sudo lsof +c 0 -i:22

pranshuparmar•1mo ago

Quick update, witr now supports macOS as well. You can install it using brew - https://github.com/pranshuparmar/witr?tab=readme-ov-file#81-...

Sayyidalijufri•1mo ago

Good job

BTW any chance you would make MacOS version of this?

pranshuparmar•1mo ago

Thank you, mac is already supported, only with the very first release it wasn't. You can install it via brew.

Sayyidalijufri•1mo ago

Thanks Good job

_mig5•1mo ago

Great tool! I was looking to convert my decades-old shell script into something a bit more modern and user-friendly, and lo and behold, this appeared right at the same time :) I'll just use yours instead. Well done! :)

pranshuparmar•1mo ago

Quick update: witr now supports Linux, macOS, Windows, and FreeBSD.

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Show HN: MCP App to play backgammon with your LLM

Show HN: I spent 4 years building a UI design tool with only the features I use

Show HN: If you lose your memory, how to regain access to your computer?

Show HN: I'm 75, building an OSS Virtual Protest Protocol for digital activism

Show HN: I built Divvy to split restaurant bills from a photo

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

Show HN: Smooth CLI – Token-efficient browser for AI agents

Show HN: ARM64 Android Dev Kit

Show HN: BioTradingArena – Benchmark for LLMs to predict biotech stock movements

Show HN: Slack CLI for Agents

Show HN: I Hacked My Family's Meal Planning with an App

Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust

Show HN: I built a free UCP checker – see if AI agents can find your store

Show HN: Gigacode – Use OpenCode's UI with Claude Code/Codex/Amp

Show HN: Compile-Time Vibe Coding

Show HN: Slop News – HN front page now, but it's all slop

Show HN: Daily-updated database of malicious browser extensions

Show HN: Horizons – OSS agent execution engine

Show HN: Micropolis/SimCity Clone in Emacs Lisp

Show HN: Falcon's Eye (isometric NetHack) running in the browser via WebAssembly

Show HN: Fitspire – a simple 5-minute workout app for busy people (iOS)

Show HN: I built a RAG engine to search Singaporean laws

Show HN: Local task classifier and dispatcher on RTX 3080

Show HN: Sem – Semantic diffs and patches for Git

Show HN: A password system with no database, no sync, and nothing to breach

Show HN: FastLog: 1.4 GB/s text file analyzer with AVX2 SIMD

Show HN: GitClaw – An AI assistant that runs in GitHub Actions

Show HN: Gohpts tproxy with arp spoofing and sniffing got a new update

Show HN: I built a directory of $1M+ in free credits for startups

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Show HN: MCP App to play backgammon with your LLM

Show HN: I spent 4 years building a UI design tool with only the features I use

Show HN: If you lose your memory, how to regain access to your computer?

Show HN: I'm 75, building an OSS Virtual Protest Protocol for digital activism

Show HN: I built Divvy to split restaurant bills from a photo

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

Show HN: Smooth CLI – Token-efficient browser for AI agents

Show HN: ARM64 Android Dev Kit

Show HN: BioTradingArena – Benchmark for LLMs to predict biotech stock movements

Show HN: Slack CLI for Agents

Show HN: I Hacked My Family's Meal Planning with an App

Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust

Show HN: I built a free UCP checker – see if AI agents can find your store

Show HN: Gigacode – Use OpenCode's UI with Claude Code/Codex/Amp

Show HN: Compile-Time Vibe Coding

Show HN: Slop News – HN front page now, but it's all slop

Show HN: Daily-updated database of malicious browser extensions

Show HN: Horizons – OSS agent execution engine

Show HN: Micropolis/SimCity Clone in Emacs Lisp

Show HN: Falcon's Eye (isometric NetHack) running in the browser via WebAssembly

Show HN: Fitspire – a simple 5-minute workout app for busy people (iOS)

Show HN: I built a RAG engine to search Singaporean laws

Show HN: Local task classifier and dispatcher on RTX 3080

Show HN: Sem – Semantic diffs and patches for Git

Show HN: A password system with no database, no sync, and nothing to breach

Show HN: FastLog: 1.4 GB/s text file analyzer with AVX2 SIMD

Show HN: GitClaw – An AI assistant that runs in GitHub Actions

Show HN: Gohpts tproxy with arp spoofing and sniffing got a new update

Show HN: I built a directory of $1M+ in free credits for startups

Show HN: Witr – Explain why a process is running on your Linux system

Comments