witr-process-inspector：Go语言进程/端口原因查询工具，快速定位服务启动链

witr-process-inspector by aradotso/trending-skills

224 周安装量

8 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/aradotso/trending-skills --skill witr-process-inspector

开发运维命令行工具监控

🇨🇳中文介绍

witr — 为什么它在运行？

Skill by ara.so — Daily 2026 Skills 系列。

witr 是一个 Go 语言编写的 CLI/TUI 工具，用于回答任何进程、服务或端口“为什么在运行？”的问题。它无需您手动关联 ps、lsof、ss、systemctl 和 docker ps 的输出，而是清晰地展示因果关系链——显示正在运行的东西从何而来、如何启动，以及由哪个监督者/容器/Shell 链负责。

安装

最快方式 (Unix)

curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash

最快方式 (Windows PowerShell)

irm https://raw.githubusercontent.com/pranshuparmar/witr/main/install.ps1 | iex

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

主要命令与标志

# 通过 PID 检查进程
witr <pid>

# 通过进程名检查（子字符串匹配）
witr <name>

# 检查绑定到端口的进程
witr --port <port>
witr -p <port>

# 启动交互式 TUI 仪表板
witr --interactive
witr -i

# 显示所有运行中的进程及其因果关系信息
witr --all
witr -a

# 输出为 JSON 格式（用于脚本）
witr --json <pid>

# 跟随/监视模式 — 自动刷新
witr --watch <pid>
witr -w <pid>

# 详细输出 — 显示完整的环境变量和元数据
witr --verbose <pid>
witr -v <pid>

# 按用户过滤进程
witr --user <username>

# 显示版本
witr --version

标志	简写	描述
`--port`	`-p`	通过端口号检查
`--interactive`	`-i`	启动 TUI 仪表板
`--all`	`-a`	显示所有进程
`--json`		输出为 JSON 格式
`--watch`	`-w`	自动刷新/跟随
`--verbose`	`-v`	完整元数据输出
`--user`		按操作系统用户过滤
`--version`		打印版本

交互式 TUI 模式

启动完整仪表板：

witr -i
# 或
witr --interactive

TUI 按键绑定：

按键	操作
`↑` / `↓`	导航进程列表
`Enter`	展开进程详情 / 因果关系链
`f`	过滤/搜索进程
`s`	按列排序
`r`	刷新
`j`	切换 JSON 视图
`q` / `Ctrl+C`	退出

witr 1234



PID: 1234
名称: node
二进制文件: /usr/local/bin/node
启动时间: 2026-03-18 09:12:44
用户: ubuntu

为什么它在运行？
  └─ 启动者: npm (PID 1200)
       └─ 启动者: bash (PID 1180)
            └─ 启动者: sshd (PID 980)
                 └─ 启动者: systemd (PID 1) [服务: sshd.service]

witr --port 8080



端口: 8080 (TCP, LISTEN)
进程: python3 (PID 4512)
二进制文件: /usr/bin/python3
用户: deploy

为什么它在运行？
  └─ 启动者: gunicorn (PID 4490)
       └─ 启动者: systemd (PID 1) [服务: myapp.service]
            单元文件: /etc/systemd/system/myapp.service
            ExecStart: /usr/bin/gunicorn app:app --bind 0.0.0.0:8080

JSON 输出（用于脚本）

witr --json 4512



{
  "pid": 4512,
  "name": "python3",
  "binary": "/usr/bin/python3",
  "user": "deploy",
  "started_at": "2026-03-18T09:00:00Z",
  "causality_chain": [
    {"pid": 4490, "name": "gunicorn", "type": "parent"},
    {"pid": 1,    "name": "systemd",  "type": "supervisor", "service": "myapp.service"}
  ]
}

监视/跟随一个进程

# 每 2 秒刷新一次
witr --watch 4512

查找谁启动了端口监听器

# 快速检查：谁占用了 5432 端口 (Postgres)?
witr --port 5432

# 获取机器可读的输出用于自动化
witr --json --port 5432 | jq '.causality_chain[-1].service'

审计所有运行中的服务

# 列出所有进程及其因果关系，管道输出到 less
witr --all | less

# 将完整审计导出到 JSON
witr --all --json > audit.json

检查 Docker/容器进程

# witr 理解容器边界
witr <pid-of-containerized-process>
# 输出将显示：容器 → 容器运行时 → systemd 链

在 Shell 脚本中使用

#!/usr/bin/env bash
# 检查 8080 端口是否被占用以及原因
if witr --json --port 8080 > /tmp/witr_out.json 2>/dev/null; then
  SERVICE=$(jq -r '.causality_chain[-1].service // "unknown"' /tmp/witr_out.json)
  echo "端口 8080 由服务占用: $SERVICE"
else
  echo "端口 8080 未被使用"
fi

按用户过滤进程

# 仅显示由 www-data 用户拥有的进程及其运行原因
witr --all --user www-data

平台	架构	备注
Linux	amd64, arm64	完全支持
macOS	amd64, arm64 (Apple Silicon)	完全支持
Windows	amd64	完全支持
FreeBSD	amd64, arm64	完全支持

Go 集成（嵌入 witr 逻辑）

如果您想在 Go 项目中以编程方式使用 witr：

go get github.com/pranshuparmar/witr



package main

import (
    "fmt"
    "github.com/pranshuparmar/witr/pkg/inspector"
)

func main() {
    // 通过 PID 检查进程
    result, err := inspector.InspectPID(1234)
    if err != nil {
        panic(err)
    }

    fmt.Printf("进程: %s\n", result.Name)
    for _, link := range result.CausalityChain {
        fmt.Printf("  └─ %s (PID %d)\n", link.Name, link.PID)
    }
}



// 通过端口检查
result, err := inspector.InspectPort(8080, "tcp")
if err != nil {
    panic(err)
}
fmt.Printf("端口 8080 由 PID %d (%s) 占用\n", result.PID, result.Name)

某些 PID 权限被拒绝

# witr 需要读取 /proc (Linux) 或等效路径的权限
# 对于系统级进程，请使用 sudo 运行
sudo witr <pid>
sudo witr --port 80

安装后找不到二进制文件

# 确保安装路径在 PATH 环境变量中
export PATH="$PATH:/usr/local/bin"   # Unix 默认安装路径
# 对于 Go 安装：
export PATH="$PATH:$(go env GOPATH)/bin"

端口未找到 / 无输出

# 首先确认端口确实在监听
ss -tlnp | grep <port>       # Linux
netstat -an | grep <port>    # macOS/Windows

# 然后重试
witr --port <port>

# 确保终端支持 256 色
export TERM=xterm-256color
witr --interactive

# 如果在 Windows 上，使用 Windows Terminal 以获得最佳 TUI 体验

进程在检查前已退出

# witr 只能检查当前正在运行的进程
# 对长时间运行的进程使用 --watch 来监视它
witr --watch <pid>

macOS：某些进程需要提升权限

# 系统完整性保护可能会限制某些进程元数据的访问
sudo witr <pid>

witr <pid>              # 为什么 PID X 在运行？
witr <name>            # 为什么进程 "nginx" 在运行？
witr -p <port>         # 8080 端口上是什么，为什么？
witr -i                # 交互式 TUI 仪表板
witr -a                # 显示所有进程 + 因果关系
witr --json <pid>      # 机器可读输出
witr -w <pid>          # 监视/跟随一个进程
witr -v <pid>          # 详细模式：完整环境变量 + 元数据
witr --user <user>     # 按操作系统用户过滤

🇺🇸English

witr — Why Is This Running?

Skill by ara.so — Daily 2026 Skills collection.

witr is a Go CLI/TUI tool that answers "why is this running?" for any process, service, or port. Instead of leaving you to correlate ps, lsof, ss, systemctl, and docker ps manually, witr makes the causality chain explicit — showing where a running thing came from, how it was started, and what chain of supervisors/containers/shells is responsible.

Installation

Quickest (Unix)

curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash

Quickest (Windows PowerShell)

irm https://raw.githubusercontent.com/pranshuparmar/witr/main/install.ps1 | iex

Package Managers

# Homebrew (macOS/Linux)
brew install witr

# Conda
conda install -c conda-forge witr

# Arch Linux (AUR)
yay -S witr-bin

# Windows winget
winget install -e --id PranshuParmar.witr

# Windows Scoop
scoop install main/witr

# Alpine / apk
sudo apk add --allow-untrusted ./witr-*.apk

# Go source install
go install github.com/pranshuparmar/witr/cmd/witr@latest

Key Commands & Flags

Basic Usage

# Inspect a process by PID
witr <pid>

# Inspect by process name (substring match)
witr <name>

# Inspect what's bound to a port
witr --port <port>
witr -p <port>

# Launch interactive TUI dashboard
witr --interactive
witr -i

# Show all running processes with causality info
witr --all
witr -a

# Output as JSON (for scripting)
witr --json <pid>

# Follow/watch mode — refresh automatically
witr --watch <pid>
witr -w <pid>

# Verbose output — show full environment and metadata
witr --verbose <pid>
witr -v <pid>

# Filter processes by user
witr --user <username>

# Show version
witr --version

Common Flag Reference

Flag	Short	Description
`--port`	`-p`	Inspect by port number
`--interactive`	`-i`	Launch TUI dashboard
`--all`	`-a`	Show all processes
`--json`

Interactive TUI Mode

Launch the full dashboard:

witr -i
# or
witr --interactive

TUI Keybindings:

Key	Action
`↑` / `↓`	Navigate process list
`Enter`	Expand process detail / causality chain
`f`	Filter/search processes
`s`	Sort by column
`r`	Refresh
`j`

Example Outputs

Inspect a PID

witr 1234



PID: 1234
Name: node
Binary: /usr/local/bin/node
Started: 2026-03-18 09:12:44
User: ubuntu

Why is this running?
  └─ Started by: npm (PID 1200)
       └─ Started by: bash (PID 1180)
            └─ Started by: sshd (PID 980)
                 └─ Started by: systemd (PID 1) [service: sshd.service]

Inspect by Port

witr --port 8080



Port: 8080 (TCP, LISTEN)
Process: python3 (PID 4512)
Binary: /usr/bin/python3
User: deploy

Why is this running?
  └─ Started by: gunicorn (PID 4490)
       └─ Started by: systemd (PID 1) [service: myapp.service]
            Unit file: /etc/systemd/system/myapp.service
            ExecStart: /usr/bin/gunicorn app:app --bind 0.0.0.0:8080

JSON Output (for scripting)

witr --json 4512



{
  "pid": 4512,
  "name": "python3",
  "binary": "/usr/bin/python3",
  "user": "deploy",
  "started_at": "2026-03-18T09:00:00Z",
  "causality_chain": [
    {"pid": 4490, "name": "gunicorn", "type": "parent"},
    {"pid": 1,    "name": "systemd",  "type": "supervisor", "service": "myapp.service"}
  ]
}

Watch/Follow a Process

# Refresh every 2 seconds
witr --watch 4512

Common Patterns

Find Who Started a Port Listener

# Quick check: who owns port 5432 (Postgres)?
witr --port 5432

# Get machine-readable output for automation
witr --json --port 5432 | jq '.causality_chain[-1].service'

Audit All Running Services

# List everything with causality, pipe to less
witr --all | less

# Export full audit to JSON
witr --all --json > audit.json

Inspect a Docker/Container Process

# witr understands container boundaries
witr <pid-of-containerized-process>
# Output will show: container → container runtime → systemd chain

Use in a Shell Script

#!/usr/bin/env bash
# Check if port 8080 is in use and why
if witr --json --port 8080 > /tmp/witr_out.json 2>/dev/null; then
  SERVICE=$(jq -r '.causality_chain[-1].service // "unknown"' /tmp/witr_out.json)
  echo "Port 8080 is owned by service: $SERVICE"
else
  echo "Port 8080 is not in use"
fi

Filter Processes by User

# Show only processes owned by www-data and why they're running
witr --all --user www-data

Platform Support

Platform	Architectures	Notes
Linux	amd64, arm64	Full support
macOS	amd64, arm64 (Apple Silicon)	Full support
Windows	amd64	Full support
FreeBSD	amd64, arm64	Full support

Go Integration (Embedding witr Logic)

If you want to use witr programmatically in a Go project:

go get github.com/pranshuparmar/witr



package main

import (
    "fmt"
    "github.com/pranshuparmar/witr/pkg/inspector"
)

func main() {
    // Inspect a process by PID
    result, err := inspector.InspectPID(1234)
    if err != nil {
        panic(err)
    }

    fmt.Printf("Process: %s\n", result.Name)
    for _, link := range result.CausalityChain {
        fmt.Printf("  └─ %s (PID %d)\n", link.Name, link.PID)
    }
}



// Inspect by port
result, err := inspector.InspectPort(8080, "tcp")
if err != nil {
    panic(err)
}
fmt.Printf("Port 8080 owned by PID %d (%s)\n", result.PID, result.Name)

Troubleshooting

Permission Denied on Some PIDs

# witr needs read access to /proc (Linux) or equivalent
# Run with sudo for system-level processes
sudo witr <pid>
sudo witr --port 80

Binary Not Found After Install

# Ensure install location is in PATH
export PATH="$PATH:/usr/local/bin"   # Unix default install
# or for Go installs:
export PATH="$PATH:$(go env GOPATH)/bin"

Port Not Found / No Output

# Confirm port is actually listening first
ss -tlnp | grep <port>       # Linux
netstat -an | grep <port>    # macOS/Windows

# Then retry
witr --port <port>

TUI Not Rendering Correctly

# Ensure terminal supports 256 colors
export TERM=xterm-256color
witr --interactive

# If on Windows, use Windows Terminal for best TUI experience

Process Exited Before Inspection

# witr can only inspect currently running processes
# Use --watch on a long-running process to monitor it
witr --watch <pid>

macOS: Requires Elevated Access for Some Processes

# System Integrity Protection may restrict some process metadata
sudo witr <pid>

Quick Reference Card

witr <pid>              # Why is PID X running?
witr <name>            # Why is process "nginx" running?
witr -p <port>         # What's on port 8080 and why?
witr -i                # Interactive TUI dashboard
witr -a                # Show all processes + causality
witr --json <pid>      # Machine-readable output
witr -w <pid>          # Watch/follow a process
witr -v <pid>          # Verbose: full env + metadata
witr --user <user>     # Filter by OS user

Weekly Installs

224

Repository

aradotso/trending-skills

GitHub Stars

First Seen

5 days ago

Security Audits

Gen Agent Trust HubFail SocketWarn SnykFail

Installed on

github-copilot223

codex223

amp223

cline223

kimi-cli223

gemini-cli223

Azure 升级评估与自动化工具 - 轻松迁移 Functions 计划、托管层级和 SKU

73,200 周安装