You ever restart your desktop and wonder what changed since yesterday?
Or why that window manager tweak broke three things at once?
I’ve been there. ewmhisto is a command-line tool that shows you the history of your desktop environment. It’s not magic. It’s just logs (plain) text records of what your window manager did, when it did it, and what state it was in.
Most people don’t know those logs exist. Or if they do, they assume reading them means decoding hieroglyphics. They’re wrong.
This article walks you through ewmhisto step by step. No jargon. No assumptions about your CLI skills.
Just real commands. Real output. Real results.
Why trust this? Because I’ve used ewmhisto to fix broken keybindings, recover lost layouts, and figure out why my focus settings flipped overnight. Not theory.
Not docs copied from GitHub. Actual use. Actual mistakes.
Actual fixes.
You’ll learn how to run it. How to read what it spits out. And how to spot patterns (like) when your compositor crashes every time you plug in a second monitor.
By the end, you’ll know what happened on your desktop yesterday, last week, or five minutes ago. You’ll debug faster. You’ll understand your system better.
You’ll stop guessing.
What ewmhisto Actually Does
I run ewmhisto every day. It’s not magic. It’s a log viewer for your window manager.
You know when a window vanishes and you have no idea why? Or when focus jumps around like it’s possessed? ewmhisto shows you exactly what happened. Windows opening, closing, moving, gaining or losing focus.
Nothing more. Nothing less.
Think of it like a security camera pointed at your desktop. Not recording video. Just timestamped events.
(Yes, it’s boring. That’s the point.)
It works because of EWMH. A set of rules that lets your window manager talk to panels, docks, and taskbars. ewmhisto listens in on those conversations.
Why bother? Because debugging desktop weirdness is guesswork without logs. Did that app crash before or after the panel froze?
You won’t know until you check.
You can get started with Ewmhisto in under two minutes. No config needed.
I keep it running in a terminal tab. Always. You’ll wonder how you lived without it.
Especially on Ubuntu 24.04 with Hyprland (that) combo loves to misbehave slowly.
Run ewmhisto Right Now
Open your terminal. Not sure how? On Linux or macOS, it’s usually in Applications > Utilities or just search “terminal”.
Windows users. Grab Windows Terminal from the Microsoft Store. It’s faster and less annoying.
Type this:
ewmhisto
Hit Enter.
It shows the last few window events. Like when you opened Chrome, switched to Slack, or minimized a window. No flags.
No setup. Just raw output. You’re seeing what your desktop actually did, not what some app says it did.
Wait. Did you get command not found?
Yeah. That means it’s not installed yet. On Ubuntu or Debian: sudo apt install ewmh.
Arch? Try yay -S ewmh or paru -S ewmh. macOS with Homebrew? brew install ewmh.
Don’t overthink it. Install it. Run it.
See what pops up. Is that Firefox event really from 3 seconds ago. Or did your clock drift?
(It happens.)
You’re not configuring anything yet.
Just watching.
What’s the first thing you notice in the output? Is it what you expected? Or does it make you go “huh (so) that’s how my desktop actually works”?
Try it now. Seriously. Stop reading.
Open the terminal. Type ewmhisto. Come back when you’ve seen three lines scroll by.
What That ewmhisto Output Actually Says
I ran ewmhisto and stared at the scroll.
You did too.
It spits out lines like this:
1715234890.123 Window Focus Changed: 0x04a00001 (Firefox)
That first number? Timestamp. Seconds since 1970.
The part after the colon? The window ID. The name in parentheses?
Usually the app you see. Not always right (but) close enough.
1715234892.456 Window Mapped: 0x04b00002 (Terminal)
Mapped means opened. Not launched. appeared on screen. Unmapped means gone.
Closed. Minimized? Nope.
Just vanished from view.
You’re wondering: How do I know which window is which?
Match the hex ID (like 0x04a00001) to what you see in xwininfo -root -tree.
Or just watch the app names (they’re) often correct.
Focus changed? That’s when you clicked into a window. Might be Firefox.
Might be your terminal. Might be that weird popup you didn’t ask for.
You want to track a specific app?
Filter with grep: ewmhisto | grep Firefox
No magic. No jargon. Just timestamps, events, IDs, and names.
You already know most of it. You just didn’t know the labels.
Still not sure what “mapped” means? It means the window drew itself. Nothing more.
Nothing less.
Filter What You See
I run ewmhisto every morning.
It shows me what happened overnight.
Sometimes I only care about the last five things. That’s when I use -n 5. No guessing.
No scrolling. Just five lines.
You ever stare at twenty events and think I don’t need all of these? Yeah. Me too.
The -n flag cuts it down fast. Try ewmhisto -n 10 if you want the last ten. It works every time.
I once missed a failed backup because it was buried under seventeen other logs. Now I just type -n 3 and check the top three. Done in two seconds.
Can you combine flags? Yes. ewmhisto -n 7 works with other options. But most days, -n is all I need.
What if you want to skip the noise and jump to something recent? There’s no -s option. Not yet.
Don’t waste time looking for it.
Real talk: if you’re using ewmhisto, you’re already saving time. Adding -n makes it sharper. Like turning up the focus on a lens.
You don’t need ten options to get useful output.
You need one that fits what you’re doing right now.
So ask yourself: how many entries do I actually need to see? Then type -n and that number. That’s it.
When ewmhisto Saves Your Sanity
My window vanished.
What happened right before that?
I run ewmhisto and see the exact moment the window manager killed it. No guessing. Just facts.
Why does this app keep losing focus? I watch the event log scroll by. Turns out another program is stealing focus every 47 seconds.
(Yes, I timed it.)
Debugging a weird crash? It shows you the five events before the freeze. Not theories.
Raw sequence.
Curious how your desktop actually works? Run it for two minutes. You’ll spot patterns no GUI reveals.
The Ewmhisto sisterhood empowerment by emergewomanmagazine page surprised me. Not with tech, but with how people use tools like this to take back control.
You ever stare at a blank desktop and wonder who’s really in charge? I did. Then I ran ewmhisto.
Your Desktop Has a Memory
I know you’re tired of guessing what changed on your desktop. You open a window and wonder why it’s there. You close something and forget what it was.
That’s where ewmhisto comes in.
It shows you what actually happened. Not what you think happened.
No more digging through logs or second-guessing yourself.
Try it now. Open your terminal right now and run ewmhisto. See your desktop’s story unfold.
Live, clear, yours.
You wanted control.
You got it.