# witr | Pranshu Parmar | Knowledge Base | Instagit

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

GitHub Stars: 20.2k

Repository: https://github.com/pranshuparmar/witr

---

## Articles

### [How the witr TUI Visually Integrates Process Details with the Process Ancestry Tree View](/pranshuparmar/witr/how-witr-tui-integrates-process-details-with-ancestry-tree)

Discover how the witr TUI visually integrates process details with its ancestry tree view. Learn about its dynamic interface and context-aware navigation.

- Tags: architecture
- Published: 2026-08-10

### [Exact vs Substring Process Name Matching in witr: How They Differ](/pranshuparmar/witr/witr-exact-vs-substring-process-name-matching)

Understand exact vs substring process name matching in witr. Learn how witr finds processes using different matching modes to improve your workflow.

- Tags: deep-dive
- Published: 2026-08-10

### [What Warnings Does witr Generate for Suspicious Process Behavior? Full Detection Guide](/pranshuparmar/witr/witr-warnings-for-suspicious-process-behavior)

Discover the 14 warning categories witr generates for suspicious process behavior, including service instability, resource exhaustion, and tampering indicators. Learn how witr protects your system.

- Tags: deep-dive
- Published: 2026-08-10

### [How witr Detects and Interprets tmux and screen Sessions as Valid Process Sources](/pranshuparmar/witr/how-witr-detects-tmux-screen-sessions-as-process-sources)

Learn how witr identifies tmux and screen sessions as valid process sources by examining process ancestry and environment variables like TMUX and STY.

- Tags: internals
- Published: 2026-08-10

### [How witr Uses Systemd Socket Activation to Resolve Ports](/pranshuparmar/witr/how-witr-handles-systemd-socket-activation-for-port-resolution)

Learn how witr uses systemd socket activation to resolve ports by querying systemd for unit info. Discover port ownership without inspecting file descriptors.

- Tags: internals
- Published: 2026-08-10

### [What Process Metrics Does witr Collect in Verbose Mode? A Deep Dive into Extended Process Telemetry](/pranshuparmar/witr/witr-verbose-mode-process-metrics-collection)

Discover the extended process telemetry collected by witr in verbose mode. Explore detailed memory, I/O, file descriptors, threads, capabilities, and env vars.

- Tags: deep-dive
- Published: 2026-08-10

### [How witr Detects and Identifies SSH Sessions and Remote Terminal Connections from Source Code](/pranshuparmar/witr/how-witr-detects-ssh-sessions-and-remote-terminals)

Discover how witr detects SSH sessions and remote terminal connections by analyzing process ancestry and environment variables. Learn its reliable identification methods.

- Tags: how-to-guide
- Published: 2026-08-10

### [How the JSON Output Mode in witr Handles Multiple Input Sources](/pranshuparmar/witr/witr-json-output-mode-multiple-inputs)

Learn how witr's JSON output mode efficiently handles multiple input sources by aggregating results and errors into a single JSON array for seamless processing.

- Tags: deep-dive
- Published: 2026-08-10

### [How witr Manages Environment Variable Display on Platforms with Restricted Access](/pranshuparmar/witr/witr-environment-variable-display-on-restricted-platforms)

Discover how witr gracefully handles restricted access to environment variables. Learn about its platform specific extraction and empty slice fallback for a seamless user experience.

- Tags: how-to-guide
- Published: 2026-08-10

### [How witr Detects Complex Supervisor Chains Like PM2 and systemd](/pranshuparmar/witr/how-witr-detects-supervisor-chains-pm2-systemd)

Learn how witr detects complex supervisor chains like PM2 and systemd. It builds a process ancestry tree and uses a layered pipeline to identify systemd and scan ancestors for supervisors.

- Tags: deep-dive
- Published: 2026-08-10

### [witr Exit Codes Reference: How to Handle Errors in Shell Scripts](/pranshuparmar/witr/witr-exit-codes-and-script-handling)

Learn witr exit codes 0-4 to handle shell script errors effectively. Understand success, usage, config, and runtime failures for robust automation.

- Tags: api-reference
- Published: 2026-08-10

### [How witr Implements Adaptive Refresh Rates and Mouse Navigation in Its Bubble Tea TUI](/pranshuparmar/witr/witr-tui-adaptive-refresh-and-mouse-navigation)

Explore how the witr TUI implements adaptive refresh rates with self-tuning loops and mouse navigation by converting input into UI actions. Learn about its innovative techniques.

- Tags: internals
- Published: 2026-08-10

### [What Dangerous Linux Capabilities Does witr Identify and Warn About?](/pranshuparmar/witr/witr-warnings-for-dangerous-linux-capabilities)

Discover the dangerous Linux capabilities witr identifies like CAP_SYS_ADMIN and CAP_NET_RAW in non-root processes. Enhance your system security today.

- Tags: deep-dive
- Published: 2026-08-10

### [How witr Extracts and Displays Git Repository Context for Running Processes](/pranshuparmar/witr/how-witr-extracts-git-repository-context-for-processes)

Learn how witr finds and shows Git repo context for running processes by analyzing working directories and HEAD references. Get clear CLI output for your workflow.

- Tags: internals
- Published: 2026-08-10

### [Platform-Specific Process Resolution in witr: Linux, macOS, and Windows Differences Explained](/pranshuparmar/witr/witr-platform-specific-process-resolution-linux-macos-windows)

Explore witr's platform specific process resolution strategies for Linux macOS and Windows. Learn how witr adapts to each OS for efficient process detection.

- Tags: deep-dive
- Published: 2026-08-10

### [How witr Detects LD_PRELOAD and DYLD_* Library Injection in Linux and macOS Processes](/pranshuparmar/witr/how-witr-detects-library-injection-ld-preload-dyld)

witr detects and warns about LD_PRELOAD and DYLD_* library injection attacks on Linux and macOS by scanning process environment variables against defined rules.

- Tags: internals
- Published: 2026-08-10

### [How witr Resolves Ports to Processes When the Socket Is Owned by PID 1](/pranshuparmar/witr/how-witr-resolves-ports-to-pid-1-owned-sockets)

Learn how witr resolves ports to processes for PID 1 owned sockets. Discover how it finds the true owner of file descriptors in /proc for accurate port attribution.

- Tags: internals
- Published: 2026-08-10

### [Witr Source Detection Priority Order Explained: How Process Origin Is Determined](/pranshuparmar/witr/witr-source-detection-priority-order-and-reasoning)

Understand the witr source detection priority order. Learn how witr identifies process origins with eleven platform specific checks, ensuring accuracy and minimizing false positives.

- Tags: deep-dive
- Published: 2026-08-10

### [How witr Detects and Handles Container Runtimes: Docker, Podman, Kubernetes, and LXC Explained](/pranshuparmar/witr/how-witr-detects-containers-docker-podman-k8s-lxc)

Learn how witr detects and handles Docker, Podman, Kubernetes, and LXC runtimes. Discover its cgroup parsing and CLI resolution techniques for process identification.

- Tags: internals
- Published: 2026-08-10

### [How witr Tracks Process Start Times and Restart Counts: A Deep Dive into the Source Code](/pranshuparmar/witr/witr-process-start-time-restart-count-tracking)

Discover how witr tracks process start times and restart counts by analyzing kernel timestamps and service manager data. Understand the source code behind this essential monitoring.

- Tags: deep-dive
- Published: 2026-08-09

### [How Witr Detects Container Healthcheck Statuses: Runtime Parsing and Configuration Analysis](/pranshuparmar/witr/witr-container-healthcheck-status-detection)

Discover how witr detects container healthcheck statuses by parsing runtime strings and analyzing configuration. Get clear insights for your CLI output.

- Tags: deep-dive
- Published: 2026-08-09

### [How witr Detects Processes Managed by PM2 and Supervisor](/pranshuparmar/witr/witr-pm2-supervisor-detection)

Learn how witr detects processes managed by PM2 and supervisor by traversing the process ancestry chain and matching executable names. Understand the detection mechanism.

- Tags: how-to-guide
- Published: 2026-08-09

### [How witr Detects Cron and systemd Timer Schedules: Process Ancestry and systemd Integration](/pranshuparmar/witr/witr-cron-systemd-timer-schedule-detection)

Discover how witr detects Cron and systemd timer schedules by examining process ancestry and integrating with systemd. Learn about witr's innovative detection methods.

- Tags: internals
- Published: 2026-08-09

### [How witr Detects SSH Sessions and Remote IP Addresses](/pranshuparmar/witr/witr-ssh-session-remote-ip-detection)

witr detects SSH sessions by traversing the process tree and extracts remote IPs from environment variables. Learn how witr monitors your SSH connections.

- Tags: deep-dive
- Published: 2026-08-09

### [How witr Adapts Color Themes for Light and Dark Terminals](/pranshuparmar/witr/witr-color-theme-adaptation-light-dark-terminals)

Discover how witr seamlessly adapts color themes for light and dark terminals using Lipgloss AdaptiveColor. Enjoy high contrast without manual configuration.

- Tags: internals
- Published: 2026-08-09

### [How witr Implements Auto-Refresh and Adaptive Refresh Rates in Its TUI](/pranshuparmar/witr/witr-tui-auto-refresh-adaptive-refresh-rate)

Discover how witr uses a Bubble Tea tick driver and adaptive logic for auto-refresh and dynamic refresh rates in its TUI, optimizing data updates between 3 and 30 seconds.

- Tags: internals
- Published: 2026-08-09

### [Does Witr Support Mouse Input and Click-to-Sort in Its TUI?](/pranshuparmar/witr/witr-tui-mouse-support-click-to-sort)

Discover if witr's TUI supports mouse input and click-to-sort. Learn how witr leverages Bubble Tea for interactive table sorting and mouse functionality.

- Tags: feature-support
- Published: 2026-08-09

### [How witr Detects Memory Usage and RSS Across Different Platforms](/pranshuparmar/witr/witr-memory-usage-rss-detection-platforms)

Discover how witr detects memory usage and RSS on Windows macOS and Linux. Learn about its platform specific implementations and data collection strategies.

- Tags: deep-dive
- Published: 2026-08-09

### [How witr Detects LD_PRELOAD by Inspecting Process Environment Variables](/pranshuparmar/witr/witr-environment-variable-inspection-ldpreload-detection)

Learn how witr detects LD_PRELOAD by inspecting process environment variables. Discover its detection rules and matching process in this technical deep dive.

- Tags: internals
- Published: 2026-08-09

### [Understanding witr Exit Codes for Scripting and CI Integration](/pranshuparmar/witr/witr-exit-code-meanings-scripting-ci-integration)

Learn what witr exit codes mean for scripting and CI integration. Understand success, errors, and failures to streamline your workflows.

- Tags: deep-dive
- Published: 2026-08-09

### [How witr Handles Multi-Target Queries with Mixed Input Types](/pranshuparmar/witr/witr-multi-target-query-handling-mixed-input-types)

Learn how witr handles multi-target queries with mixed input types. It processes any combination of repeatable target flags and name arguments sequentially for clear output.

- Tags: deep-dive
- Published: 2026-08-09

### [Witr Warnings for Dangerous Capabilities and Library Injection: A Complete Guide](/pranshuparmar/witr/witr-warning-system-dangerous-capabilities-library-injection)

Witr warns about dangerous Linux capabilities and library injection via environment variables in non-root processes. Secure your systems effectively.

- Tags: how-to-guide
- Published: 2026-08-09

### [How witr Detects Git Repositories and Branches from a Working Directory](/pranshuparmar/witr/witr-git-repository-branch-detection-working-directory)

Learn how witr detects Git repositories and branches by traversing your working directory and parsing .git entries and HEAD files. Discover Git repo names and current branches.

- Tags: internals
- Published: 2026-08-09

### [How witr Handles Signal Operations in the TUI: Kill, Terminate, Pause, and Renice](/pranshuparmar/witr/witr-tui-signal-handling-kill-terminate-pause-renice)

Discover how witr's TUI manages signal operations like kill, terminate, pause, and renice using platform-agnostic syscall wrappers for efficient process control.

- Tags: internals
- Published: 2026-08-09

### [How witr Detects the Source of systemd, launchd, and rc.d Services](/pranshuparmar/witr/witr-service-source-detection-systemd-launchd-rcd)

Learn how witr detects systemd, launchd, and rc.d service sources by analyzing process ancestry and applying platform-specific detectors for detailed unit information.

- Tags: deep-dive
- Published: 2026-08-09

### [Platform-Specific Process Discovery in witr: /proc, ps, and Win32 API Differences](/pranshuparmar/witr/witr-platform-differences-proc-ps-win32-api)

Discover platform-specific process handling in witr: explore /proc on Linux, ps on macOS/BSD, and Win32 APIs on Windows to understand how witr gathers process data.

- Tags: internals
- Published: 2026-08-09

### [Understanding the witr JSON Output Schema: Complete Field Reference](/pranshuparmar/witr/witr-json-output-schema-field-meanings)

Explore the witr JSON output schema, detailing Target, Process, Ancestry, and Warnings fields for process state and system context. Understand your data.

- Tags: api-reference
- Published: 2026-08-09

### [How witr Visualizes Process Trees Including Child Processes](/pranshuparmar/witr/witr-process-tree-visualization-child-processes)

Learn how witr visualizes process trees with child processes using ASCII connectors and dynamic indentation. Explore the internals of witr's process hierarchy rendering.

- Tags: how-to-guide
- Published: 2026-08-09

### [Architecture of the Interactive TUI in witr: How Tab Navigation Works](/pranshuparmar/witr/witr-interactive-tui-architecture-tab-navigation)

Explore the witr TUI architecture built with Bubble Tea. Learn how the centralized MainModel manages four data views and enables seamless keyboard and mouse tab navigation.

- Tags: architecture
- Published: 2026-08-09

### [How witr Detects File Locks on Linux, macOS, and FreeBSD](/pranshuparmar/witr/witr-file-lock-detection-linux-macos-freebsd)

Learn how witr detects file locks on Linux, macOS, and FreeBSD using platform-specific system calls and kernel interfaces. Understand the underlying mechanisms for effective file lock management.

- Tags: internals
- Published: 2026-08-09

### [How to Detect Containers with witr Across Docker, Podman, Kubernetes, and LXC](/pranshuparmar/witr/witr-container-detection-docker-podman-kubernetes-lxc)

Learn how to detect containers across Docker, Podman, Kubernetes, and LXC with witr. Discover its runtime-registry pattern for effortless container visibility.

- Tags: how-to-guide
- Published: 2026-08-09

### [How witr Traces Process Ancestry Chains: Core Algorithm and Implementation](/pranshuparmar/witr/how-witr-traces-process-ancestry-chains)

Discover how witr traces process ancestry chains by walking PPIDs back to the root process. Learn about its core algorithm and implementation details.

- Tags: deep-dive
- Published: 2026-08-09