I’ve watched people stare at broken desktops for twenty minutes before typing history and hoping it helps.
It doesn’t.
ewmhisto is not magic. It’s a command-line tool that shows you what your window manager actually did (session) by session, window by window, change by change.
You’ve closed a terminal and lost the command you ran five minutes ago. You’ve rebooted and wondered why your layout reset. You’ve seen windows snap somewhere weird and thought did I do that?
Yeah. You’re not alone.
Most guides assume you already know how to read timestamps, parse logs, or guess which flag does what.
This one doesn’t.
I’ve used ewmhisto on three different machines (two) with tiling WMs, one with a hacked-together stacking setup. It worked. It broke.
I fixed it. Then I wrote this.
No jargon. No “just trust me.”
If you can type ls, you can use ewmhisto.
You’ll learn how to run it. How to read its output without squinting. How to spot when something went sideways (and) how to roll back before it gets worse.
By the end, you’ll know what happened, when it happened, and why it matters.
What ewmhisto Actually Does
It shows you what your window manager did. Not what you think it did. What it actually did.
I run it when my focus jumps weirdly and nothing seems to have changed. Then I scroll back. And there it is.
A window popped up, minimized itself, and stole focus. No icon. No notification.
Just gone.
That’s what ewmhisto does. It logs window opens, closes, moves, resizes, and focus shifts. All the quiet chaos your desktop hides from you.
Think of it like a security camera pointed at your taskbar. Not flashy. Not opinionated.
Just records.
It’s built on EWMH (a) set of rules that lets your window manager talk to panels, docks, and status bars. Without those rules? Everything ignores everything else.
With them? You get logs like this.
Why bother? Because when your app vanishes, or focus loops, or windows stack invisibly. You need facts.
Not guesses.
You’ve already tried restarting. You’ve checked configs. You’re tired of blaming yourself.
So why not see what really happened?
learn more about how it catches what your eyes miss.
It’s not magic. It’s just history. And history doesn’t lie.
(Unlike my memory.)
Why ewmhisto Won’t Run (And Why That’s Not Your Fault)
You type ewmhisto and get command not found. I’ve done it too. It’s not you.
It’s the system.
First (open) your terminal. On Linux or macOS, that’s usually Ctrl+Alt+T or Spotlight + “Terminal”. Windows?
Use PowerShell or Windows Terminal (not Command Prompt (it) won’t cut it).
Now try ewmhisto. If it works, you’ll see a short list of recent window manager events. No flags.
No setup. Just raw output.
But if it fails? Yeah. That’s normal. ewmhisto isn’t built into most systems.
You need to install it first.
On Ubuntu or Debian:
sudo apt install ewmh
On Arch:
sudo pacman -S ewmh
On macOS with Homebrew:
brew install ewmh
That package includes ewmhisto. Don’t overthink it. Just run the install command.
Then try ewmhisto again. Still stuck? Check your shell’s PATH.
(Or just restart the terminal (90%) of PATH issues vanish after that.)
You’re not missing something obvious. This tool assumes you already have the right pieces. It doesn’t tell you what’s missing.
So go ahead (run) it now. See what shows up. Even if it’s just five lines, that’s real data.
Not theory. Not docs. Actual output.
You want proof it works?
There it is.
What That ewmhisto Output Actually Says
I run ewmhisto and stare at the wall of text.
You do too.
First thing you’ll see? A timestamp. Like 1712345678.901.
That’s seconds since January 1, 1970 (not) human-readable, but precise. (Yes, it’s annoying. Yes, we live with it.)
Then comes the event type. Window Focus Changed. Window Mapped. Window Unmapped. Those aren’t jargon. They’re what just happened to a window on your screen.
Next: a window ID like 0x1a00001. That’s how X11 tracks windows. It’s useless unless you pair it with xwininfo -id 0x1a00001 or xprop | grep WM_NAME.
You’ll also spot window titles (sometimes) clean (Firefox, Terminal), sometimes messy ([no name], emacs@host:~). Titles lie. IDs don’t.
A line like 1712345678.901 Window Focus Changed 0x1a00001 Firefox means Firefox just got clicked. Not Chrome. Not Slack.
Firefox.
Window Mapped means something opened.
Window Unmapped means it closed (or) minimized (X11 doesn’t always care).
You want to know which app? Match the ID. Or pipe into xwininfo -id live.
Don’t guess. Don’t skim.
Why does this matter? Because if your window manager misbehaves, this is where you start. Not in forums.
Not in guesses. Here.
Filter What You See
I run ewmhisto when I need to check what just happened. Not the whole log. Just the part that matters.
The -n option cuts it down fast. ewmhisto -n 10 shows only the last 10 events. You want the last 5? Use -n 5.
Why scroll through 200 lines when you only care about the latest crash?
The -s option lets you jump in at a point. Say you know something broke at 3:42 PM. You can start there instead of scanning from the top.
(But honestly. I rarely use -s. Most days, -n is all I need.)
You stack options. ewmhisto -n 5 -s "2024-04-12 15:42" gives you five entries starting at that time. It’s not magic. It’s just less typing and fewer mistakes.
I use this when debugging live systems. Or when someone yells “What changed?” and I need proof in under ten seconds. You ever stare at a wall of logs and feel dumb?
Yeah. Don’t do that.
This isn’t theory. I ran ewmhisto -n 3 yesterday. Found the bad config line in 8 seconds.
No fluff. No guessing. Just the facts you asked for.
When ewmhisto Actually Saves Your Ass
I use ewmhisto when my window vanishes and I have no idea why. It logs every window event in real time. No guessing.
My window disappeared. What happened right before that? ewmhisto shows the exact moment it was unmapped, hidden, or reparented.
Why does this program keep losing focus?
The log reveals focus shifts you never saw (like) a notification stealing attention or a script hijacking input.
Advanced users lean on it for debugging race conditions.
You see the raw sequence: map → focus → unmap → crash.
Curious how your desktop really works? Run ewmhisto for five minutes. You’ll rethink everything.
It’s not magic. It’s just logging what your system already does. You can read more about the ewmhisto sisterhood empowerment by emergewomanmagazine if that resonates.
Most tools hide complexity. ewmhisto exposes it. I prefer that.
Your Desktop’s Story Starts Now
I know you’re tired of guessing what changed on your desktop.
You want answers (not) more mystery.
ewmhisto gives you those answers.
It shows you exactly what happened, when, and why.
No more digging through logs.
No more hoping something stuck.
You asked for control.
This is it.
Open your terminal right now and try ewmhisto.
See your desktop’s story unfold (live,) clear, yours.
Do it before you close this tab.
Carolety Graysons is the kind of writer who genuinely cannot publish something without checking it twice. Maybe three times. They came to women's empowerment news through years of hands-on work rather than theory, which means the things they writes about — Women's Empowerment News, Women in Leadership Profiles, Fashion and Style Tips, among other areas — are things they has actually tested, questioned, and revised opinions on more than once.
That shows in the work. Carolety's pieces tend to go a level deeper than most. Not in a way that becomes unreadable, but in a way that makes you realize you'd been missing something important. They has a habit of finding the detail that everybody else glosses over and making it the center of the story — which sounds simple, but takes a rare combination of curiosity and patience to pull off consistently. The writing never feels rushed. It feels like someone who sat with the subject long enough to actually understand it.
Outside of specific topics, what Carolety cares about most is whether the reader walks away with something useful. Not impressed. Not entertained. Useful. That's a harder bar to clear than it sounds, and they clears it more often than not — which is why readers tend to remember Carolety's articles long after they've forgotten the headline.
