witr
Trace a running process, port, or container back to what launched it
What it is
witr is a command-line tool with an interactive terminal UI that explains why something is running on a machine. Point it at a process, port, container, or file and it walks the chain of parents, supervisors, services, and shells responsible, such as systemd starting PM2 starting node. Output can be human-readable or JSON. Sysadmins and DevOps engineers reach for it during troubleshooting and incident response instead of piecing together ps, lsof, ss, and systemctl output by hand.