What causes "no process ancestry found" in pranshuparmar/witr?

Verify the starting pid is alive before calling (kill -0 ).

no process ancestry found

Error message

no process ancestry found

What it means

ResolveAncestry walks the parent chain (pid -> ppid) building a chain of ancestors. If the walk terminates without collecting a single entry (len(chain)==0) — i.e. the starting process could not be found or its parent link could not be read — it returns 'no process ancestry found'. The initial pid itself counts as a chain entry only when its record is readable.

Source

Thrown at internal/proc/ancestry.go:35

			break // loop protection
		}
		seen[current] = true

		p, err := ReadProcess(current)
		if err != nil {
			break
		}

		chain = append(chain, p)

		if p.PPID == 0 || p.PID == 1 {
			break
		}
		current = p.PPID
	}

	if len(chain) == 0 {
		return nil, fmt.Errorf("no process ancestry found")
	}

	// Reverse the chain to get root
	for i, j := 0, len(chain)-1; i < j; i, j = i+1, j-1 {
		chain[i], chain[j] = chain[j], chain[i]
	}

	return chain, nil
}

View on GitHub (pinned to dc4fa1da82)

Solutions

Verify the starting pid is alive before calling (kill -0 <pid>).
Re-run with elevated privileges if the process belongs to another user or namespace.
Retry shortly — if the pid is being reaped, a fresh snapshot may resolve; otherwise treat as permanent.
Pass a valid, existing pid from a fresh process listing instead of a cached one.

Example fix

// before
chain, err := proc.ResolveAncestry(pid) // pid may have exited
// after
if err := syscall.Kill(pid, 0); err != nil {
    return fmt.Errorf("pid %d already exited; cannot resolve ancestry", pid)
}
chain, err := proc.ResolveAncestry(pid)

Defensive patterns

Strategy: validation

Validate before calling

func pidAlive(pid int) bool {
    return syscall.Kill(pid, 0) == nil
}
if !pidAlive(pid) {
    return fmt.Errorf("pid %d is gone; cannot resolve ancestry", pid)
}

Try / catch

chain, err := proc.ResolveAncestry(pid)
if err != nil {
    if strings.Contains(err.Error(), "no process ancestry found") {
        log.Printf("pid %d vanished before ancestry walk; retrying once", pid)
        chain, err = proc.ResolveAncestry(pid)
    }
    if err != nil { return err }
}

Prevention

Check pid liveness (signal 0) immediately before the ancestry walk.
Retry once on short-lived processes — they often exit mid-lookup.
Run with privileges covering the target's user/namespace.
Use pids from a fresh process snapshot, not cached values.

When it happens

Trigger: Calling ResolveAncestry with a pid that no longer exists; the process table lookup for the root pid fails immediately (permission denied or zombie reaped) so the loop body never appends to chain.

Common situations: Race where a short-lived process exits before the ancestry walk starts; querying a child of a containerized/hidden process from outside its namespace; insufficient privileges to read another user's process records; integration tests using an already-reaped pid.

Related errors

AI-assisted analysis of pranshuparmar/witr@dc4fa1da82 (2026-09-01). Data as JSON: /api/errors/69ee63452ed45d8f. Report an issue: GitHub.