Simple X11 keylogger.
- Simple output format: One line on
stdoutper key event. - Simple to audit: One short file of modern C.
- Simple to run: Does not need
sudo.
Given no options, xkbcat prints only keypresses, one per line. Here's the
output when I type "Hi":
Shift_L
h
i
With key-ups enabled (xkbcat -up), the format changes to show them:
+Shift_L
+h
-h
-Shift_L
+i
-i
Lines starting + are key-downs; - are key-ups.
Just make.
Don't have X11/extensions/XInput2.h? Install your distro's libxi-devel
package.
Options you can pass (all optional):
-display <display>: set target X display (default:0)-up: also prepend key-ups (default: don't)-help: print usage hints and exit
Then just use your computer as usual. Interrupt signal (C-c) to quit.
- If you need to log keys across a whole Linux system (also in the
framebuffer—not just in X11), try keysniffer. It works via a kernel
module, and needs
sudo. - If you want to see what characters the user actually typed (with modifier
keys, backspace, etc resolved into text),
xspyorlogkeysmight be better for you.
- If you want to add timestamps to each line for logging purposes, I recommend
piping to the moreutils package's
ts. These answers feature various other tools good for the purpose. - If you only want to see key names when you press keys in the same terminal
where
xkbcatis running, you can temporarily disable terminal echo withstty -echo && xkbcat. (sttyis in coreutils.)
-
xinput invoked as
xinput --test-xi2 --rootlogs everything input-related; even mouse movements and clicks, and touchpad stuff. Its output is very comprehensive, but harder to parse. -
If you need to log X11 events more generally, various protocol monitoring programs are listed in the X11 debugging guide.
The git-tagged version numbers follow semver.
Error outputs (on stderr) are intended to be read by people. Changes to their wording are not considered breaking changes. Don't parse them programmatically.
ISC.