Ewmhisto

You ever wonder what your desktop was doing five minutes ago?
Or why that window vanished and you can’t get it back?

I’ve been there.
And I found ewmhisto.

It’s not magic. It’s a command-line tool that shows you the history of your desktop environment. Think of it like an undo button for your whole session.

Most people don’t know how to track changes in their window manager. They reboot instead of checking what changed. They guess instead of seeing.

That’s broken.

This article shows you how to use ewmhisto. No command-line experience needed. I walk you through real examples.

Not theory. Not jargon. Just what works.

You’ll learn how to spot problems before they snowball. How to recover lost states. How to see exactly what your system did.

And when.

I wrote this because I spent hours debugging things I could’ve fixed in seconds with ewmhisto.

You’ll walk away knowing how to run it. How to read its output. How to use it when something feels off.

No fluff. No assumptions. Just clear steps.

And why each one matters.

You’ll understand your desktop better. You’ll fix issues faster. You’ll stop guessing.

What ewmhisto Actually Does

I use Ewmhisto every day. It’s not magic. It’s a log.

It watches your window manager. Not your apps. Not your CPU.

Your window manager. The thing that decides where windows go and which one is on top.

It records when windows open. When they close. When you drag them.

When you click into one and it grabs focus.

That’s it. No fluff. No guessing.

Think of it like a security camera pointed at your desktop’s control panel. You don’t see icons or files. You see events: “Firefox gained focus”, “Terminal moved to x=120 y=80”, “Thunar closed”.

This ties into EWMH. Extended Window Manager Hints. That’s just a shared language so your bar, your launcher, and your window manager can all understand each other.

Why care? Because when something breaks (say) your keyboard shortcuts stop working. You check the log right before it broke.

You spot the odd event. You find the real cause.

You don’t wait for a crash. You watch what happens before the crash.

Most people only notice their window manager when it fails.
ewmhisto lets you see what it’s doing while it’s still working.

Run ewmhisto Right Now

Open your terminal. That’s it. No setup.

No config. Just open it.

Type ewmhisto and hit Enter.

It prints the last few window manager events. Nothing fancy. Just raw, recent activity.

Like a window opening or focus shifting.

You’re probably staring at blank output right now.
Or worse. command not found.

That means it’s not installed.

On Ubuntu or Debian? Run sudo apt install ewmh. Fedora?

Try sudo dnf install ewmh. Arch? It’s in the AUR as ewmh-git.

Don’t overthink it. Install it. Then run it again.

You’ll see timestamps. Window IDs. Event types.

It’s not pretty. It’s not meant to be.

But it is real data. Straight from your X11 session.

Why does this matter?
Because if you’re debugging window focus issues or scripting desktop automation, this is your first real clue.

No GUI. No abstraction. Just what actually happened.

Try it now. Seriously. Stop reading.

Open the terminal. Type the command.

What do you see? Is it empty? Did it crash?

Did it flood your screen?

That’s your starting point. Not documentation. Not theory.

Your screen. Your output.

You don’t need permissions to run it.
You do need to know it exists.

Now you do.

What ewmhisto Spits Out (And Why It Matters)

I run ewmhisto and stare at the flood of lines. You do too. What the hell is all this?

First line: 1712345678.901 Window Focus Changed: 0x01a2b3c4 (Firefox.) That timestamp? Seconds since 1970. Not pretty, but precise.

The event type tells you what changed. Not why. The hex number is the X11 window ID.

Unique. Permanent for that window’s life.

Next: 1712345682.345 Window Mapped: 0x01a2b3c4 (Terminal.) Mapped means opened. Unmapped means closed. Focus changed means you clicked it or Alt-Tabbed into it.

Simple. No magic.

How do you know which app it is? Look at the title after the dash. Sometimes it says `.

Chromium-browseror (emacs.) Sometimes it’s blank or generic like (xterm.) That’s when you cross-check the ID withxwininfo -id 0x01a2b3c4`.

You’re already asking: Which one is my browser? Which one just stole focus?
I ask that every time. It’s not obvious until you match IDs to real windows.

Real example: I saw Window Focus Changed: 0x05f6e7d8 (then) ran xwininfo -id 0x05f6e7d8 and got Google-chrome. No guesswork. Just proof.

Cut the noise. See what matters.

I run ewmhisto when something feels off. Not to scroll forever. To find the real problem fast.

The -n flag is my first move. ewmhisto -n 10 shows only the last 10 events. Why look at 200 lines when the crash happened five minutes ago?

You ever stare at a wall of logs and think which one was it? Yeah. Me too.

That’s why -n exists.

The -s option lets you jump in mid-stream. Say you know the issue started at 3:15 PM. ewmhisto -s "2024-04-12 15:15" drops you right there. (No, it doesn’t guess your coffee break time.)

Combine them. ewmhisto -n 5 -s "2024-04-12 15:15" gives you five lines starting exactly where things went sideways. It’s like rewinding a sports replay to the exact frame the pass got dropped.

You don’t need all the data.
You need the right data (now.)

Ever try to debug while your boss stands behind you? That’s when -n and -s stop being options. They become reflexes.

This isn’t about power-user flexing.
It’s about not losing your cool because you scrolled past the error three times.

Use ewmhisto like a scalpel. Not a sledgehammer. One command.

One answer. Done.

When ewmhisto Saves Your Sanity

My window vanished.
What happened right before that?

ewmhisto shows you the exact sequence of window manager events. No guessing. No restarting X.

Why does that app keep stealing focus? Run ewmhisto, click around, and watch the log. You’ll see focus shifts, map requests, property changes.

Raw and real.

It’s not just for bugs.
It’s for when you want to know why your desktop does what it does.

Advanced users use it to trace race conditions or misbehaving clients. I once caught a dock app silently reparenting windows (and) killing them in the process. (Turns out it hated my DPI setting.)

Curious how your DE really works? Try ewmhisto for five minutes. You’ll never look at window management the same way.

The Ewmhisto sisterhood empowerment by emergewomanmagazine page shows how others turned that curiosity into real control.

Your Desktop Has a Memory

I know you’re tired of guessing what changed on your desktop. You open a window and wonder why it’s there. You close something and forget what it was.

ewmhisto fixes that.

It shows you what happened. Not guesses. Not assumptions.

Actual history.

You don’t need to memorize it. Just try it.

Open your terminal right now and run ewmhisto.

See your desktop’s story unfold (in) real time.

That blank screen? It’s not empty. It’s waiting for you to look.

Go ahead. Type it. Hit enter.

You’ll know in five seconds whether it matters to you.

It does.