You ever wonder what your desktop was doing five minutes ago?
Or why that window vanished and you can’t get it back?
I’ve been there.
And I found ewmhisto.
It’s a command-line tool. It shows you the history of your desktop environment (what) windows opened, closed, moved, or resized. No magic.
No guessing. Just plain logs of what actually happened.
Most people don’t track this stuff. They reboot when things break. They assume the window manager is just “acting up” (it’s not).
You’re probably thinking: Can I really see that? Is it even worth learning?
Yes.
And it’s simpler than you think.
This article walks you through ewmhisto step by step. No jargon. No assumptions about your CLI skills.
Just clear instructions (and) why each one matters.
You’ll learn how to run it. How to read its output. How to spot patterns when something goes wrong.
This isn’t theory.
I’ve used it to fix real problems (like) lost terminals and stuck focus.
By the end, you’ll know exactly what ewmhisto does (and) how to use it when you need answers.
What ewmhisto Actually Does
I run ewmhisto when my windows start acting weird.
It logs what your window manager does (not) what you click, but what happens: windows opening, closing, moving, losing or gaining focus.
Think of it like a security camera pointed at your desktop’s nervous system. (Not the UI. The wiring underneath.)
It’s built on EWMH (a) set of rules that let parts of your desktop talk to each other. Not magic. Just agreed-upon signals.
Why care? Because when something breaks, you’re left guessing. Did that app crash?
Did the window manager drop focus? Did a script move the window offscreen?
ewmhisto shows you the timeline. You see the exact order things happened.
No interpretation. No guesses. Just events, in order.
You don’t get this from ps or top. Those show processes. This shows window state changes.
Ever closed a window and it vanished without a trace? You’ll see the “unmap” event.
Ever switched workspaces and lost a window? It logged the focus shift.
You ask: What changed right before it broke?
ewmhisto answers.
It’s not flashy. It doesn’t draw graphs. It just writes plain text as things happen.
And that’s why it works.
Run ewmhisto Right Now
Open your terminal. On Linux, press Ctrl+Alt+T. On macOS, open Terminal from Applications > Utilities.
Windows users? Use Windows Terminal or PowerShell (not Command Prompt (it’s) too old for this).
Type ewmhisto and hit Enter.
That’s it.
It prints the last few window manager events. Like app focus changes or workspace switches. No config.
No setup. Just raw output.
You’ll probably get “command not found”.
Yeah, I did too.
Install it with sudo apt install ewmh on Ubuntu or Debian. For Arch? Try sudo pacman -S ewmh.
Fedora users: sudo dnf install ewmh-utils.
Don’t google for hours.
Just pick your distro and run the right command.
Then run ewmhisto again. Watch the timestamps scroll. See how fast Firefox grabs focus when you click it?
Or how your terminal loses it when you Alt+Tab away?
This isn’t magic. It’s just listening. You’re seeing what your desktop actually does, not what it says it does.
Try it now.
Before you overthink it.
What’s the first event you spot?
Is it what you expected?
I saw my file manager steal focus three times in ten seconds. Turns out it was auto-refreshing. (Who knew?)
What Those ewmhisto Lines Actually Say
I run ewmhisto and stare at the scroll. You do too. Why does it look like line noise?
Here’s what each chunk means.
Timestamps tell you when. Like 1712345678.901. That’s seconds since 1970.
Unix time. (Yes, it’s ugly. Yes, we all copy-paste it into a converter.)
Event types tell you what. Window Focus Changed means you clicked into a window. Window Mapped means something just opened. it Unmapped means it closed or minimized.
Then comes the window title or ID. Firefox or Alacritty. That’s the app name if it reported one. Sometimes it’s just 0x01a2b3c4, a raw X11 window ID.
(You’ll need xwininfo -id 0x01a2b3c4 to dig deeper.)
You’re probably asking: Which line matches the window I just clicked?
Look for Window Focus Changed right after your click.
Then check the title next to it.
Is it blank? The app didn’t set one. Is it generic like Dialog?
You’ll need the ID and xwininfo.
This isn’t magic. It’s just X11 spitting out facts. No fluff.
No guesses. Just timestamps, verbs, and IDs. You learn to read it like text messages.
Short, blunt, and full of context you already know.
Filter What You See
I run ewmhisto every morning. It shows me what happened yesterday. But sometimes I only want the last five things.
That’s where -n comes in. ewmhisto -n 5 gives me five lines. Not ten. Not twenty.
Five. I use it when my terminal is cluttered and my brain is still waking up.
You ever scroll past thirty events just to find one thing? Yeah. Me too.
The -s option lets you start from a point in time. Like ewmhisto -s "2024-06-12 09:00" to see everything after 9 a.m. It’s not magic.
It’s just time math. (And yes, it accepts relative times like "-2h".)
I combine them all the time. ewmhisto -n 3 -s "-1h" shows the last three events from the past hour. That saved me twice last week. Once during a roll out.
Once during a panic.
You don’t need all the data. You need the right data. Right now.
Why wait for fifty lines when three tell the story? Try it. Type it.
Hit enter. See how fast it gets quiet.
When ewmhisto Actually Saves Your Ass
My window vanished. I ran ewmhisto. It showed me the exact X11 event that killed it.
Right before I alt-tabbed into Slack.
You ever wonder why your app loses focus every time you open a PDF? ewmhisto logs the focus shifts. No guessing. Just timestamps and event types.
Debugging a race condition in your window manager config?
This tool shows the raw sequence. No abstractions, no lies.
It’s not magic. It’s just events. And yes (I’d) pick ewmhisto over ten stack traces any day.
Curious how your desktop really works? Turn it on for five minutes. Watch focus, map, unmap, configure events scroll by like a security cam of your GUI.
Check out the ewmhisto sisterhood empowerment by emergewomanmagazine if you want real talk about who builds these tools. And why.
Your Desktop’s Story Starts Now
I know you’re tired of guessing what changed on your desktop.
You want answers (not) mystery.
ewmhisto gives you that. No more blind spots. No more digging through logs.
Just clear, real-time history.
You already care about control.
So why wait for the next weird behavior to show up?
Open your terminal right now and run ewmhisto.
See your desktop’s story unfold. Live.
Try it.
Then tell me what you found.