xkbcat 
Simple X11 keylogger.
- Simple output format: One line on
stdoutper key event. - Simple to audit: One short file of modern C.
- Simple to run: Does not need
sudo.
Examples
Keypresses only
Given no options, xkbcat prints only keypresses, one per line. Here's the
output when I type "Hi":
Shift_L
h
i
Keypresses and key-ups
With key-ups enabled (xkbcat -up), the format changes to show them:
+Shift_L
+h
-h
-Shift_L
+i
-i
Lines starting + are key-downs; - are key-ups.
Compilation
Just make.
Don't have X11/extensions/XInput2.h? Install your distro's libxi-devel
package.
Usage
Options you can pass (all optional):
-display <display>: set target X display (default:0)-up: also prepend key-ups (default: don't)-help: print usage hints and exit
Then just use your computer as usual. Interrupt signal (C-c) to quit.
Related programs
Other keyloggers
- If you need to log keys across a whole Linux system (also in the
framebufferโnot just in X11), try keysniffer. It works via a kernel
module, and needs
sudo. - If you want to see what characters the user actually typed (with modifier
keys, backspace, etc resolved into text),
xspyorlogkeysmight be better for you.
Programs that work well together with xkbcat
- If you want to add timestamps to each line for logging purposes, I recommend
piping to the moreutils package's
ts. These answers feature various other tools good for the purpose. - If you only want to see key names when you press keys in the same terminal
where
xkbcatis running, you can temporarily disable terminal echo withstty -echo && xkbcat. (sttyis in coreutils.)
Programs for logging other X11 events
-
xinput invoked as
xinput --test-xi2 --rootlogs everything input-related; even mouse movements and clicks, and touchpad stuff. Its output is very comprehensive, but harder to parse. -
If you need to log X11 events more generally, various protocol monitoring programs are listed in the X11 debugging guide.
Versioning
The git-tagged version numbers follow semver.
Error outputs (on stderr) are intended to be read by people. Changes to their wording are not considered breaking changes. Don't parse them programmatically.
License
ISC.