36

I need to record every keystroke and store in a file in the user directory ~, when using my account, I am not sudoer and I cannot install programs (like logKeys) in any way. How could I do so using terminal?

NOTE: This question it's not a duplicate of the other mention question; in this question I'm asking about every keystroke, while in the other the asker asked about keystroke in terminal session.

8
  • Do you mean any key character/byte coming from a given terminal device, or any key press/release even from any keyboard connected to the host computer? May 13, 2014 at 9:39
  • Every connected kryboard
    – Mitro
    May 13, 2014 at 9:49
  • 2
    @etherfish it is not a duplicate because, I don't mean only in terminal session, but every keystroke, also in desktop, when no program is running.
    – Mitro
    May 13, 2014 at 13:12
  • 1
    In a GUI (X11) session? Or on a Linux console? What's a terminal got to do with this, since you don't want only a record of what you typed in a terminal? May 13, 2014 at 23:16
  • 1
    @AlessioMTX You're correct. My mistake.
    – etherfish
    May 14, 2014 at 6:10

2 Answers 2

57
+50

xinput test can report all keyboard events to the X server. On a GNU system:

xinput list |
  grep -Po 'id=\K\d+(?=.*slave\s*keyboard)' |
  xargs -P0 -n1 xinput test

If you want to get key names from the key codes, you could post-process that output with:

awk 'BEGIN{while (("xmodmap -pke" | getline) > 0) k[$2]=$4}
     {print $0 "[" k[$NF] "]"}'

Add > file.log to store in a log file. Or | tee file.log to both log and see it.

xinput queries the XinputExtension of the X server. That's as close as you're going to get as a standard (I am not aware of any standard that covers X utilities) or common command to do that. That also does not require root privileges.

If the X server and xinput support version 2 of the XinputExtension, you can use test-xi2 instead of test which gives more information, in particular the state of the modifiers (shift, ctrl, alt...). Example:

$ xinput test-xi2 --root
EVENT type 2 (KeyPress)
    device: 11 (11)
    detail: 54
    flags:
    root: 846.80/451.83
    event: 846.80/451.83
    buttons:
    modifiers: locked 0 latched 0 base 0x4 effective: 0x4
    group: locked 0 latched 0 base 0 effective: 0
    valuators:
    windows: root 0x26c event 0x26c child 0x10006e6

You can translate the keycode (in detail) to a keysym with the help of xmodmap -pke again, and the effective modifier bitmask to something more helpful with the help of xmodmap -pm. For instance:

xinput test-xi2 --root | perl -lne '
  BEGIN{$"=",";
    open X, "-|", "xmodmap -pke";
    while (<X>) {$k{$1}=$2 if /^keycode\s+(\d+) = (\w+)/}
    open X, "-|", "xmodmap -pm"; <X>;<X>;
    while (<X>) {if (/^(\w+)\s+(\w*)/){($k=$2)=~s/_[LR]$//;$m[$i++]=$k||$1}}
    close X;
  }
  if (/^EVENT type.*\((.*)\)/) {$e = $1}
  elsif (/detail: (\d+)/) {$d=$1}
  elsif (/modifiers:.*effective: (.*)/) {
    $m=$1;
    if ($e =~ /^Key/){
      my @mods;
      for (0..$#m) {push @mods, $m[$_] if (hex($m) & (1<<$_))}
      print "$e $d [$k{$d}] $m [@mods]"
    }
  }'

would output:

KeyPress 24 [q] 0x19 [Shift,Alt,Num_Lock]

when I press Shift+Alt+q when num-lock is on.

Note that you don't need to have super-user privileges to install a program. If you have write access to somewhere on the file system where execute permission is granted (your home directory, /tmp, /var/tmp...) then you can copy an xinput command from a compatible system there and execute it.

14
  • It is very good, the output is key press n1 key press n2 key release ..Is there a way to show the letter instad of number? And how to store in a file the "log"? PS: unfortunatelly my PC doesn't have this program installed by default, and I can't install anything at the moment, I tried on another PC.
    – Mitro
    May 13, 2014 at 13:33
  • Moreover the number can't recognize if I'm using 2 or "
    – Mitro
    May 13, 2014 at 13:44
  • 2
    @AlessioMTX, all key presses will be logged though including the Shift and Capslock ones. See also my edit for key labels/symbols instead of keycodes. May 13, 2014 at 13:52
  • 1
    @AlessioMTX, you'll need xinput 1.6.1 or newer for --root. X utilities can be downloaded individually from xorg.freedesktop.org/releases/individual/app. If you don't want to compile from source. Debian has a xinput 1.6.1 for several architectures for Linux or kfreebsd. May 17, 2014 at 12:38
  • 1
    @AlessioMTX, that's meant for events to the X server. xmodmap has been in the reference X implementation since 1987 at least. What system are we talking about here? Could it be that xmodmap is not in your $PATH (/usr/dt/bin or other?). May 19, 2014 at 8:44
3

Have you considered using the script command?

1
  • It is not what I'm looking for. I read from the link but it is only for terminal session.
    – Mitro
    May 13, 2014 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .