ps aux shows you what is running on your system, but witr goes a step further and tells you why it is running by tracing where it came from.
If you’ve ever looked at ps aux late at night trying to figure out why a Node.js process is using too much memory, you’ve probably seen the PID, user, and command, but that still doesn’t answer the real questions: who started it, what started it, and why is it still running?
To find that out manually, you usually end up running multiple commands like systemctl status, lsof, ss -tlnp, and digging into /proc// just to piece everything together.