I’ve watched people stare at broken desktops for twenty minutes. They know something changed. They just don’t know what or when.
That’s where ewmhisto comes in. It’s not magic. It’s a command-line tool that shows you the history of your window manager.
Like a log of every time you opened, closed, or moved a window.
You’re probably here because something went sideways. Maybe your layout reset itself. Maybe an app vanished and won’t come back.
Or maybe you’re just curious what your desktop actually did yesterday.
I get it. Most guides assume you already know shell syntax. This one doesn’t.
We start from zero. No jargon. No “just run this and trust me.”
You’ll see exactly what each command does (and) why it matters.
You’ll learn how to read the output. How to spot patterns. How to catch problems before they snowball.
This isn’t theory. I’ve used it to fix my own desktop three times this week. You’ll walk away knowing how to use ewmhisto.
Not just copy-paste it.
Let’s go.
What ewmhisto Actually Tracks
I run ewmhisto when my windows start acting weird.
It logs what your window manager does (not) what you think it does.
Windows opening. Closing. Jumping to another workspace.
Losing focus while you type. Gaining focus when you click.
That’s it. No fluff. No guesses.
It’s not a performance monitor. It’s not watching CPU or memory. It watches window state changes.
Think of it like a security camera pointed at your desktop. But only recording door openings, not people walking by.
The “EWMH” part? That’s just the rulebook your desktop uses to talk to itself. ewmhisto listens in.
Why care? Because when a window vanishes or refuses to resize, you need to know what happened right before. Not guess.
You’ve already asked yourself: What changed right before this broke?
This answers that.
It doesn’t fix things. It shows you the trail.
Some tools tell you how fast your system runs. ewmhisto tells you what actually happened.
And that matters more than speed when something’s broken.
You don’t need theory. You need facts. This gives you facts.
Short logs. Clear timestamps. Real events.
No interpretation. Just data.
How to Run ewmhisto (Right Now)
Open your terminal. Not sure how? On Linux, press Ctrl+Alt+T.
On macOS, open Terminal from Applications > Utilities. Windows users. Grab Windows Terminal from the Microsoft Store.
That’s it. No flags. No setup.
Type this and hit Enter:
ewmhisto
It runs. You’ll see a short list of recent window manager events (focus) changes, app switches, workspace moves. Real-time stuff.
Not logs. Not guesses. Actual EWMH signals your desktop just sent.
What if you get command not found? Then it’s not installed. On Ubuntu or Debian: sudo apt install ewmh.
Fedora? Try sudo dnf install ewmh-utils. Arch users: yay -S ewmh-utils (or use your AUR helper).
Why does this happen? Because ewmhisto is part of the ewmh package (not) built into your system by default. (Yes, it’s weird that the tool name doesn’t match the package name.)
Try it now. Seriously (drop) everything for 30 seconds and run it. Did you see output?
Good. No output? Then something’s blocking EWMH access.
Maybe Wayland (it only works on X11).
Still stuck?
Ask yourself: Is my session actually X11?
You’d be surprised how often that’s the real issue.
What That ewmhisto Output Actually Says
I ran ewmhisto and stared at the scroll for three minutes.
You probably did too.
Here’s what those lines mean.
Timestamps show when. Not your local clock (wall-clock) time in seconds since Unix epoch. (Yes, it’s ugly.
No, you don’t need to convert it by hand.)
Then comes the event type. Like Window Focus Changed. Or MapNotify.
Or UnmapNotify. Those aren’t cryptic codes. They’re X11 events (real) things the window manager just handled.
Next: window ID. A hex number like 0x3a00006. That’s your window’s fingerprint.
Not the app name. Not the title. Just a number.
But wait. You can match it. Run xwininfo -id 0x3a00006 and get the title, class, PID.
Or use xprop | grep WM_CLASS and click the window.
MapNotify means a window opened. UnmapNotify means it closed. Or got hidden. FocusIn means you clicked into it.
Why does focus matter? Because some apps steal it. Others lose it silently.
You’ll spot that fast.
You’re not debugging X11. You’re tracing behavior. Is Chrome really stealing focus when Slack opens? ewmhisto shows you (no) guessing.
What’s the first line you always ignore? The one with NoExpose. Skip it.
It’s noise.
Still wondering which app owns window 0x2e0000a? Run xwininfo -id 0x2e0000a right now. Do it.
I’ll wait.
Filter What You See
I run ewmhisto every day. Not because I love it. Because I need to know what just broke.
The -n flag saves me time. ewmhisto -n 10 shows only the last 10 events. Why scroll through 200 lines when you only care about the crash five minutes ago?
You can combine flags. Try ewmhisto -n 5 -s "2024-04-12 14:30". That starts from a specific time and stops after five entries.
(Yes, the time format matters. No, it’s not forgiving.)
No guessing.
I used -n 3 yesterday when my service went quiet. Three lines told me exactly which config change killed it. No digging.
What do you do when the logs flood? Scroll forever? Hope something jumps out?
You don’t need all the history. You need the right part of it. Right now.
The tool doesn’t guess what you want. You tell it. With -n, you say how many.
With -s, you say where to start.
It’s not magic. It’s control. And if you’re staring at 500 lines wondering where to look.
You already know you need -n.
Try it next time. Type ewmhisto -n 7. See how fast it gets useful.
When ewmhisto Saves Your Sanity
My window vanished.
What happened right before that?
You click. You alt-tab. You swear.
Then you realize. Something hijacked focus.
ewmhisto shows you the exact order of events. No guessing. Just facts.
Why does that app keep stealing focus? It’s not magic. It’s a sequence (and) ewmhisto logs it.
Debugging feels less like witchcraft when you see the trail.
Curious how your desktop really works? Turn it on. Watch.
Learn.
The Ewmhisto sisterhood empowerment by emergewomanmagazine page surprised me. (Turns out, window managers and solidarity have more in common than I thought.)
You don’t need a PhD to use it.
Just frustration and five seconds.
Try it next time your screen betrays you.
Your Desktop Has a Memory
I know you’re tired of guessing what changed on your desktop. You open a window and wonder. *why is this here? Who moved it?
What just happened?*
ewmhisto fixes that.
It shows you the real story. Not assumptions, not guesses.
You don’t need to memorize every flag. Just type it. Watch it work.
Try one option today.
Still staring at a cluttered screen?
That confusion ends when you run the command.
Open your terminal right now and try ewmhisto to see your desktop’s story unfold.