You ever wonder what your desktop was doing five minutes ago?
Or why that window vanished and you can’t get it back?
I’ve been there.
And I wasted hours guessing instead of checking.
ewmhisto is a command-line tool that shows you the history of your desktop environment. It’s not magic. It’s just logging.
What windows opened, closed, moved, resized.
Most people don’t know how to track that. They restart their session. They reboot.
They blame the window manager.
But the history is already there.
You just need the right tool to read it.
This article walks you through ewmhisto step by step. No jargon. No assumptions.
Just what works.
You don’t need to be a terminal expert.
If you can type ls, you can use ewmhisto.
Why trust this? Because it’s written from real use (not) theory. Not docs copied and pasted.
You’ll learn how to see past states. How to spot when something went sideways. How to answer “What changed?” in under ten seconds.
By the end, you’ll understand your desktop better. You’ll fix issues faster. And you’ll stop treating your window manager like a black box.
Let’s get into it.
What ewmhisto Actually Shows You
I use Ewmhisto when my windows go rogue.
It logs what your window manager does. Not guesses. Not assumptions.
Real events.
Windows opening. Closing. Moving.
Gaining or losing focus. All of it.
Think of it like a security camera for your desktop. (Not the kind that watches you (the) kind that watches windows.)
This isn’t random logging. It’s built on EWMH (the) shared language desktop tools use to talk to each other.
Why care? Because when something breaks, you need to know what happened right before. Not five minutes ago.
Not after you restarted. Right before.
You ever click a window and nothing happens? Or a popup vanishes too fast to read?
That’s when the history matters.
It shows cause and effect. Not just “window closed” (but) which window, when, and what was focused just before.
No fluff. No interpretation. Just timestamps and events.
You want to understand your desktop? Start with what it did. Not what you think it did.
Most tools tell you where things are now.
ewmhisto tells you how they got there.
Mistakes I Made With ewmhisto
I typed ewmhisto and got “command not found”.
That was my first real moment of frustration.
You open your terminal. You type the command. Then nothing happens.
Or worse, an error.
It’s not your fault.
The tool isn’t preinstalled on most systems.
On Ubuntu or Debian? Try sudo apt install ewmh. Fedora? sudo dnf install ewmh.
Arch? yay -S ewmh or paru -S ewmh.
I wasted twenty minutes Googling the wrong package name. Turns out it’s ewmh, not ewmhisto. (Yes, the command is ewmhisto, but the package is ewmh.
Confusing, right?)
Run it with no flags and you’ll see the last few window manager events. Mouse moves. Focus shifts.
App opens. It’s raw. It’s fast.
It’s exactly what you need to debug focus issues.
I once ran it and stared at blank output for three minutes. Turns out I had no active X11 session (just) Wayland. (ewmhisto doesn’t work there.
Yet.)
Try it now. Open a terminal. Install the package.
Run the command. See what your window manager actually does.
You’ll spot weird behavior in under ten seconds.
Or you’ll realize your desktop environment is doing way too much behind your back.
That’s when things get interesting.
What That ewmhisto Output Actually Says
I ran ewmhisto while switching between Firefox and a terminal. It spat out lines. Fast.
Confusing at first.
Here’s one: 1672531200.456 Window Focus Changed: 0x01a00001 (Firefox)
That 1672531200.456? That’s a Unix timestamp. I convert it with date -d @1672531200.
You will too. The Window Focus Changed part tells you what happened. Not why, just the fact. 0x01a00001 is the X11 window ID.
It’s useless until you match it to a name.
Another line: 1672531202.789 MapNotify: 0x02b00003 (Alacritty)
MapNotify means the window opened. UnmapNotify means it closed. Not minimized. gone.
How do you know which app owns 0x02b00003? Run xwininfo -id 0x02b00003 or xprop | grep WM_NAME. You’ll see the real title.
Sometimes it lies. (Firefox loves to say “New Tab” even when you’re on Gmail.)
You don’t need to memorize every event type. Just watch for Focus, Map, and Unmap. Those three cover 90% of what you actually care about.
What’s the first thing you check when a window won’t respond? Yeah. Me too.
I grep for its name in the output.
Filter What You See
I run ewmhisto when I need to check what just happened. Not the whole log. Just the part I care about.
The -n flag cuts it down fast. ewmhisto -n 10 shows only the last 10 events. That’s it. No scrolling.
No guessing.
You ever stare at 200 lines and think which one was the crash?
Yeah. Me too. So I type -n 5.
Done.
The -s option lets you jump in mid-log. Say you know something broke at 3:42 PM. You can start there instead of digging through noise.
(But skip this if you’re just learning (keep) it simple.)
You stack flags like building blocks. ewmhisto -n 7 -s "2024-05-12 14:30" gives you seven entries from that time on. No magic. Just logic.
Real use case: your service hiccuped. You don’t want yesterday’s success logs. You want the five things right before it died.
Another: your teammate says “it broke after the config change.”
So you grab the last 3 events. Fast. Clean.
Real.
Why scroll forever when you can filter now?
What would you cut first?
When ewmhisto Actually Saves Your Day
My window vanished. I typed ewmhisto. Five seconds later, I saw the exact key combo I fat-fingered.
You’ve been there. That moment when focus jumps and you have no idea why.
It shows what happened right before the crash. Not guesses. Raw events.
Why does that app steal focus every time I alt-tab? ewmhisto logs it (no) theory needed.
Advanced users lean on it for bug hunts. You see the real sequence, not your assumptions.
Curious how your desktop really works? Run it for five minutes. You’ll spot patterns you never knew existed.
The ewmhisto sisterhood empowerment by emergewomanmagazine link? Yeah, that’s where people share real logs and fixes (not) tutorials, just straight talk.
I keep it running in a terminal tab. Always.
No fluff. No magic. Just facts, fast.
Your Desktop Has a Memory
I know you’re tired of guessing what changed on your desktop. You click. You switch windows.
You lose track.
ewmhisto fixes that.
It shows you what actually happened (no) more blind spots.
You don’t need to memorize every flag. Just type it. Try one option.
See what comes back.
You’re already sitting at your computer.
So why wait?
Open your terminal right now and try ewmhisto to see your desktop’s story unfold.
That’s it. No setup. No guesswork.
Just your history. Clear and ready.
Go.
Carolety Graysons is the kind of writer who genuinely cannot publish something without checking it twice. Maybe three times. They came to women's empowerment news through years of hands-on work rather than theory, which means the things they writes about — Women's Empowerment News, Women in Leadership Profiles, Fashion and Style Tips, among other areas — are things they has actually tested, questioned, and revised opinions on more than once.
That shows in the work. Carolety's pieces tend to go a level deeper than most. Not in a way that becomes unreadable, but in a way that makes you realize you'd been missing something important. They has a habit of finding the detail that everybody else glosses over and making it the center of the story — which sounds simple, but takes a rare combination of curiosity and patience to pull off consistently. The writing never feels rushed. It feels like someone who sat with the subject long enough to actually understand it.
Outside of specific topics, what Carolety cares about most is whether the reader walks away with something useful. Not impressed. Not entertained. Useful. That's a harder bar to clear than it sounds, and they clears it more often than not — which is why readers tend to remember Carolety's articles long after they've forgotten the headline.
