1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
.nh
.TH "WITR" "1" "Jan 2026" "" ""
.SH NAME
witr - Why is this running?
.SH SYNOPSIS
\fBwitr [process name] [flags]\fP
.SH DESCRIPTION
witr explains why a process or port is running by tracing its ancestry.
.SH OPTIONS
\fB--env\fP[=false]
show environment variables for the process
.PP
\fB-h\fP, \fB--help\fP[=false]
help for witr
.PP
\fB--json\fP[=false]
show result as JSON
.PP
\fB--no-color\fP[=false]
disable colorized output
.PP
\fB--pid\fP=""
pid to look up
.PP
\fB--port\fP=""
port to look up
.PP
\fB--short\fP[=false]
show only ancestry
.PP
\fB--tree\fP[=false]
show only ancestry as a tree
.PP
\fB--verbose\fP[=false]
show extended process information
.PP
\fB--warnings\fP[=false]
show only warnings
.SH EXAMPLE
.EX
# Inspect a running process by name
witr nginx
# Look up a process by PID
witr --pid 1234
# Find the process listening on a specific port
witr --port 5432
# Show the full process ancestry (who started whom)
witr postgres --tree
# Show only warnings (suspicious env, arguments, parents)
witr docker --warnings
# Display only environment variables of the process
witr node --env
# Short, single-line output (useful for scripts)
witr sshd --short
# Disable colorized output (CI or piping)
witr redis --no-color
# Output machine-readable JSON
witr chrome --json
# Show extended process information (memory, I/O, file descriptors)
witr mysql --verbose
# Combine flags: inspect port, show environment variables, output JSON
witr --port 8080 --env --json
.EE
|
