[{"data":1,"prerenderedAt":532},["ShallowReactive",2],{"project-46392910":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":45,"post_text":47,"what":48,"said":75,"maker_in_thread":207,"shape":218,"grid":221,"attempts":495,"same_week":496,"maker_shows":39,"maker_hidden":524,"reader_version":525,"card":526},"46392910","Witr","Explain why a process is running on your Linux system","title","Show HN: Witr – Explain why a process is running on your Linux system","https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr","github.com","pranshuparmar",1766762436,2025,526,105,62,3837,2,"legend","dev_tools","process debugging cli","cli",[24,25,26,27,28],"linux process","why is this running","pid","port debugging","process ancestry","mixed",0.329,{"positive":32,"neutral":33,"mixed":18,"critical":34},21,12,8,43,{"idea":37,"execution":40,"docs":42,"privacy":43},{"positive":38,"critical":39},6,1,{"positive":39,"critical":41},3,{"positive":39,"critical":18},{"positive":44,"critical":18},0,[46,41,46,41,44,39,39,39,44,41,44,41,39,46,44,44,44,44,44,44,39,41,46,46,44,46,46,46,46,46,41,39,39,46,46,46,46,46,46,46],5,"Hi HN,\n\nI built a small Linux CLI tool called witr (Why Is This Running?).\n\nThe idea came from a situation most of us have hit: you log into a machine, see a process or port running, and immediately wonder why it exists, who started it, and what is keeping it alive right now.\n\nwitr traces a process, service, or port back to its origin and responsibility chain and explains it in a way that’s quick to read, especially when you’re debugging under pressure.\n\nThis is v0.1.0. It’s intentionally small and focused.\nFeedback, criticism, and edge cases are very welcome.\n\nRepo: https:\u002F\u002Fgithub.com\u002Fpranshu",{"problem":49,"audience":58,"pricing":58,"motivation":59,"time_to_build":58,"stack":63,"openness":72,"stage":73,"team_size":74},{"value":50,"source":51,"evidence":52},"Understanding why a process or port is running and what started it","maker",[53,55],{"id":54},"post",{"id":56,"by":11,"text":57},"46392925","A quick note on scope: this is not meant to replace existing monitoring or observability tools. It’s designed for those moments when you SSH into a box and need to quickly…",null,{"value":60,"source":51,"evidence":61},"Quickly answering why a process exists while debugging under pressure",[62],{"id":54},[64],{"value":65,"source":66,"evidence":67},"Go","commenter",[68],{"id":69,"by":70,"text":71},"46397259","be_erik","If you're looking to build and install this from source, here's the incantation: CGO_ENABLED=0 go build -ldflags \"-X main.version=dev -X main.commit=$(git rev-parse --short HEAD)…","open_source","launched","unknown",{"praise":76,"objections":103,"requests":133,"questions":157,"alternatives":176},[77,92],{"value":78,"source":66,"evidence":79},"Useful tool for quickly explaining process origin",[80,84,88],{"id":81,"by":82,"text":83},"46395647","4ggr0","i definitely see the use for it, lots of moments where i wonder how or why something was started.",{"id":85,"by":86,"text":87},"46397825","properbrew","This is extremely useful, will be added to the toolbox. Thanks for sharing.",{"id":89,"by":90,"text":91},"46399320","tototrains","Worth mentioning: I had claude code find a crypto miner on an infected system which had been running for ~5 months undetected. Up-to-date windows 10 machine. Single prompt saying…",{"value":93,"source":66,"evidence":94},"Clean readme and simple focused design",[95,99],{"id":96,"by":97,"text":98},"46403761","scrame","This is great. One of those things that just formats and does all the little niggling things you have to do sometimes. I like that it is simple, and doesn't (thank god) need npm…",{"id":100,"by":101,"text":102},"46403392","dxdm","Very nice README, too.",[104,115,126],{"value":105,"source":66,"evidence":106},"Installing via curl is untrustworthy; wants packages",[107,111],{"id":108,"by":109,"text":110},"46398157","vzaliva","Sounds like something I could use, but installing a binary via `curl` doesn't sit right with me. Next problem you have is \"explain how this thing was installed on my system\"…",{"id":112,"by":113,"text":114},"46400234","cedsam","This is amazing and really useful to me. Great job. However, I can’t use it in a production business environment for the same reasons other users mentioned earlier. A Debian or…",{"value":116,"source":66,"evidence":117},"Relies on \u002Fproc, which malware could spoof",[118,122],{"id":119,"by":120,"text":121},"46402576","gus_","I'd not trust any app that parses \u002Fproc to obtain process information (for reasons [0]), specially if the machine has been compromised (unless by \"incident\", the author means…",{"id":123,"by":124,"text":125},"46400052","Retr0id","Regardless of code correctness, it's easy enough for malware to spoof process relationships.",{"value":127,"source":66,"evidence":128},"Reports parent process as reason, not the real why",[129],{"id":130,"by":131,"text":132},"46401076","saidnooneever","seems handy but mostly the ppid is outputted as the reason for starting. its 'who dun it', not really _why_ it was started. (service file, autorun, execve etc.) i see you support…",[134,139,150],{"value":135,"source":66,"evidence":136},"Provide deb, rpm or other system packages",[137,138],{"id":108,"by":109,"text":110},{"id":112,"by":113,"text":114},{"value":140,"source":66,"evidence":141},"Add macOS support",[142,146],{"id":143,"by":144,"text":145},"46400682","jsomedon","Brilliant stuff! Any plan to support macos?",{"id":147,"by":148,"text":149},"46418181","Sayyidalijufri","Good job BTW any chance you would make MacOS version of this?",{"value":151,"source":66,"evidence":152},"Show package manager info about the binary",[153],{"id":154,"by":155,"text":156},"46399153","filterfish","Looking up the binary in the package management system would also provide another source of useful information. Of course this would dramatically increase the complexity but…",[158,165],{"value":159,"source":66,"evidence":160},"Does it detect git repository and branch?",[161],{"id":162,"by":163,"text":164},"46397014","DougN7","What does this means for context: “Git repository name and branch” Does this mean it detects if something is running from within a git repository folder? Couldn’t find the code…",{"value":166,"source":66,"evidence":167},"Why not use systemctl status or lsof instead?",[168,172],{"id":169,"by":170,"text":171},"46406549","xk3","Note that you can do a lot of this by just querying systemctl with the PID ``` systemctl status 1 ``` And there might be more than one process using a port ``` sudo lsof +c 0…",{"id":173,"by":174,"text":175},"46397550","wyldfire","`ps uaxf` gives me pretty similar output.",[177,185,189,196,200],{"value":178,"source":66,"evidence":179},"systemctl status",[180,184],{"id":181,"by":182,"text":183},"46398474","klooney","`systemctl status $pid` will get you a lot",{"id":169,"by":170,"text":171},{"value":186,"source":66,"evidence":187},"ps uaxf",[188],{"id":173,"by":174,"text":175},{"value":190,"source":66,"evidence":191},"pstree",[192],{"id":193,"by":194,"text":195},"46395792","q2dg","pstree doesn't answer the why?",{"value":197,"source":66,"evidence":198},"lsof",[199],{"id":169,"by":170,"text":171},{"value":201,"source":66,"evidence":202},"whatis",[203],{"id":204,"by":205,"text":206},"46400180","darrenf","Is that not `whatis`? https:\u002F\u002Fwww.man7.org\u002Flinux\u002Fman-pages\u002Fman1\u002Fwhatis.1.html",{"comments":208,"answered":209,"key":210},30,7,[211,212,215],{"id":56,"text":57},{"id":213,"text":214},"46401101","Thanks, glad you liked it! As @darrenf mentioned, `whatis` can help with that use case. For now, I’m keeping `witr` focused on explaining PIDs.",{"id":216,"text":217},"46410597","Totally. Just to clarify, witr isn’t limited to ports. You can run it directly on a process too, like `witr mysql`. I used the 3306 example to emphasize this use case.",{"commenters":219,"max_depth":34,"maker_replies":208,"first_comment_mins":39,"lifespan_hours":220},61,304,[222,224,228,230,234,236,237,239,241,245,249,252,254,256,260,263,266,269,272,274,278,281,284,286,289,292,295,298,299,301,303,305,307,309,312,315,318,321,323,325,328,330,332,335,338,340,342,344,346,349,352,355,358,360,362,363,367,368,371,373,376,380,382,385,387,390,392,394,398,400,401,403,407,411,413,416,418,422,424,426,428,431,434,436,440,442,444,446,449,452,456,458,461,465,467,469,471,474,476,478,482,484,488,490,493],[56,44,44,223,11,39],"maker\u002Fneutral\u002Fidea",[225,44,46,226,227,44],"46395636","project\u002Fpositive\u002Fidea","dcminter",[154,44,41,229,155,44],"project\u002Fneutral\u002Fidea",[231,44,41,232,233,44],"46400535","project\u002Fneutral\u002Fexecution","ajb",[204,44,44,235,205,44],"other\u002Fneutral\u002Fidea",[213,44,44,223,11,39],[238,44,46,226,97,44],"46403781",[216,44,44,240,11,39],"maker\u002Fneutral\u002Fdocs",[242,39,41,243,244,44],"46396862","project\u002Fneutral\u002Fdocs","mh-",[246,39,44,247,248,44],"46397143","other\u002Fneutral\u002Fdocs","stavros",[250,39,44,247,251,44],"46397585","sestep",[253,39,44,247,248,44],"46397741",[255,39,44,247,251,44],"46397779",[257,39,39,258,259,44],"46397363","project\u002Fcritical\u002Fdocs","Neywiny",[261,39,41,243,262,44],"46398024","rzzzt",[264,39,41,243,265,44],"46398570","godelski",[267,39,39,258,268,44],"46400769","thaumasiotes",[270,39,44,271,11,39],"46401074","maker\u002Fpositive\u002Fdocs",[108,18,39,273,109,44],"project\u002Fcritical\u002Fexecution",[275,18,44,276,277,44],"46398273","other\u002Fneutral\u002Fnone","fouc",[279,18,44,276,280,44],"46401574","fph",[282,18,44,276,283,44],"46414664","Msurrow",[181,18,44,285,182,44],"commenter\u002Fneutral\u002Fnone",[287,18,44,288,11,39],"46401130","maker\u002Fneutral\u002Fexecution",[290,18,41,288,291,44],"46401611","jamescun",[293,18,44,294,11,39],"46476018","maker\u002Fpositive\u002Fexecution",[296,18,44,297,11,39],"46476042","project\u002Fpositive\u002Fexecution",[169,41,44,285,170,44],[69,300,41,232,70,44],4,[302,300,41,232,251,44],"46397568",[304,300,44,294,11,39],"46401198",[112,46,41,306,113,44],"project\u002Fmixed\u002Fexecution",[308,46,44,288,11,39],"46401179",[310,38,39,273,311,44],"46398863","zenoprax",[313,38,46,297,314,44],"46399241","zephyreon",[316,38,44,285,317,44],"46400073","otabdeveloper4",[319,38,44,320,124,44],"46400095","commenter\u002Fneutral\u002Fexecution",[322,38,44,320,317,44],"46400108",[324,38,44,285,124,44],"46400269",[326,38,44,285,327,44],"46400580","delusional",[329,38,44,285,124,44],"46400742",[331,38,44,285,317,44],"46401393",[333,38,44,276,334,44],"46403735","Jach",[336,38,44,285,337,44],"46400200","littlestymaar",[339,38,44,285,317,44],"46401406",[341,38,44,285,337,44],"46412206",[343,38,44,285,317,44],"46431116",[345,38,44,285,131,44],"46401557",[347,38,44,285,348,44],"46403885","RickyLahey",[350,38,44,351,11,39],"46401273","maker\u002Fneutral\u002Fnone",[353,38,44,285,354,44],"46399400","guywithahat",[356,38,44,285,357,44],"46399441","solarkraft",[123,38,39,359,124,44],"project\u002Fcritical\u002Fprivacy",[361,38,44,351,11,39],"46401167",[119,38,39,359,120,44],[364,38,44,365,366,44],"46407801","commenter\u002Fneutral\u002Fprivacy","dbmnt",[162,209,41,243,163,44],[369,209,41,232,370,44],"46397181","jackwilsdon",[372,209,44,288,11,39],"46401211",[374,34,46,226,375,44],"46396102","TheCraiggers",[377,34,46,378,379,44],"46396433","project\u002Fpositive\u002Fnone","giancarlostoro",[381,34,44,285,11,39],"46401240",[383,34,44,384,11,39],"46410643","project\u002Fneutral\u002Fnone",[386,34,44,285,375,44],"46410806",[388,389,44,384,11,39],"46528931",9,[130,391,41,306,131,44],10,[393,391,44,285,11,39],"46401348",[395,396,46,378,397,44],"46396732",11,"techsystems",[399,396,44,285,11,39],"46401251",[81,33,46,226,82,44],[402,33,44,285,11,39],"46401390",[404,405,46,378,406,44],"46449944",13,"_mig5",[408,409,46,378,410,44],"46399427",14,"epiccoleman",[412,409,44,285,11,39],"46401227",[414,415,44,384,11,39],"46410574",15,[96,417,46,378,97,44],16,[419,420,44,276,421,44],"46405204",17,"tacone",[85,423,46,378,86,44],18,[425,423,44,285,11,39],"46401391",[193,427,41,229,194,44],19,[429,427,44,285,430,44],"46396065","mathfailure",[432,427,39,273,433,44],"46400653","tatref",[435,427,44,232,11,39],"46401296",[437,438,41,384,439,44],"46404336",20,"gavinray",[173,32,39,441,174,44],"project\u002Fcritical\u002Fidea",[443,32,44,285,11,39],"46401305",[89,445,46,378,90,44],22,[447,445,44,285,448,44],"46399336","jbnorth",[450,445,44,285,451,44],"46400002","da_grift_shift",[453,454,46,226,455,44],"46398443",23,"fracus",[457,454,44,285,11,39],"46401396",[100,459,46,460,101,44],24,"project\u002Fpositive\u002Fdocs",[462,463,46,378,464,44],"46403146",25,"ManuelKiessling",[466,463,44,285,11,39],"46410661",[147,468,46,378,148,44],26,[470,468,44,384,11,39],"46476070",[472,468,46,473,148,44],"46538095","maker\u002Fpositive\u002Fnone",[143,475,46,378,144,44],27,[477,475,44,384,11,39],"46401245",[479,480,46,378,481,44],"46395385",28,"Saris",[483,480,44,285,11,39],"46401318",[485,486,46,378,487,44],"46395863",29,"dontdieych",[489,486,44,285,11,39],"46401324",[491,208,46,226,492,44],"46395440","canxerian",[494,208,44,285,11,39],"46401326",[],[497,502,507,511,515,520],{"id":498,"name":499,"points":500,"category":501},"46435308","HackerBook",730,"data",{"id":503,"name":504,"points":505,"category":506},"46417815","Z80-μLM",514,"ai",{"id":508,"name":509,"points":510,"category":20},"46400251","Ez FFmpeg",420,{"id":512,"name":513,"points":514,"category":501},"46442245","exopriors.com",397,{"id":516,"name":517,"points":518,"category":519},"46420453","balajmarius.com",284,"creative",{"id":521,"name":522,"points":523,"category":506},"46426624","Ensue Memory",202,false,"v2",{"id":527,"name":5,"line":6,"ai":524,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":528,"top":18,"kw":529,"maker":11,"domain":10,"tier":19,"attempts":44,"strip":530,"url":9,"mix":531,"praise":78,"objection":105,"sub":21},46392910,0.33,[24,25,26,27,28],"5353011103031500000013550555553115555555",[32,33,18,34],1794036688180]