I want to write a shell script to automate screenshots using the screenshot program Shutter when some key words are written in a certain app,such as a internet chat room or text messenger service or things like that.

Essentially, when a specific string is input, such as " its a beautiful day ", I want to be able for my shell script to screenshot that specific phrase ( and not just the whole screen in general ) and then paste the screenshot to a folder.

How would I go about writing this script, automating it, and using Shutter in my script?

  • Does the app provide any way to get these words? If not, this question is incredibly broad – muru Nov 8 '17 at 1:22
  • @muru Well, it doesn't need to under X11, as the security is so lax any app can do keylogging, and know which window it's in. However, "how to spy on someone's computer" seems a bit off topic to me. – dobey Nov 8 '17 at 1:55
  • I don't know of any program able to find a specific string on the screen and only make a screenshot of that string (though it definitely is possible e.g. using tesseract-ocr), however you could use my approach below to start scrot (or Shutter if you want, just change the command inside commands() { … }) with the -s option to interactively select the area you want to be captured. – dessert Nov 9 '17 at 9:24

Using logkeys as a keylogger

There are several keylogger programs available, I use logkeys from the repositories here. Its basic commands are:

sudo logkeys -s # start logging
sudo logkeys -k # stop logging

By default, logkeys logs the default input device to /var/log/logkeys.log. The program provides options to specify e.g. the device to be logged, the logfile path and the keymap in use, all of them can be found in man logkeys. Additionally the github README provides useful hints and troubleshooting help.

Monitoring logkeys output

To monitor the keyloggers output file, I start a shell with root permissions and use a simple while loop to constantly grep for the safety word bananayt. If the string is found, echo overwrites the logfile, effectively deleting its content so that grep won't find the same string twice. After that scrot takes a screenshot and saves it to e.g. /home/user/2017-11-08_10:00:00_screenshot.png.

while :; do
  grep -q banana /var/log/logkeys.log &&
    echo >/var/log/logkeys.log
    scrot "/home/user/$(date +%F_%T)_screenshot.png"

Of course the script also needs to be started with root permissions. You can add further commands inside the brackets or other tests with additional grep lines, e.g.

grep -q apple /var/log/logkeys.log && echo "I found an apple!"

Testing whether a specific program has the focus

To only run logkeys when a specific program has the focus I'd use xdotool to get the focused window's name with:

xdotool getactivewindow getwindowname

Putting it all together


# The script takes two arguments, the first being the keyword which triggers 
# the below commands and the second being the name of the window to monitor, 
# with support of extended regular expressions.
# Example call: sudo bash /path/to/script "banana" '.*Kate'

sleep_time="1" # sleep time between tests for focused window in seconds
logfile="/var/log/logkeys.log" # path to the keylogger's logfile
logkeys_options="-o $logfile" # options for logkeys
commands(){ # command(s) to run
  scrot "/home/user/$(date +%F_%T)_screenshot.png"

while :; do
  # test if a window with the given name is focused
  if [[ "$(xdotool getactivewindow getwindowname)" =~ $2 ]]; then
    # start logkeys if not running
    [ -e /var/run/logkeys.pid ] || logkeys -s $logkeys_options
    # search logfile for given keyword
    grep -q "$1" "$logfile" && ( echo >"$logfile"; commands )
    # stop logkeys if running
    [ -e /var/run/logkeys.pid ] && logkeys -k
  # sleep for $sleep_time seconds before testing again
  sleep $sleep_time

I suggest starting the script with e.g. sudo bash /path/to/script "banana" '.*Kate' in a terminal window which itself isn't monitored, this way you can safely terminate it with Ctrl+C.

  • when you scrot to a screenshot, does it save to a directory in the system, and if it does, can you specify the directory in the system? – dabberson567 Nov 9 '17 at 14:24
  • The file where the screenshot should be saved is the only argument to scrot, to save it at a specific location just enter the path like in scrot "/home/user/$(date +%F_%T)_screenshot.png" in the script, where /home/user/ is the path and the rest is the filename. – dessert Nov 10 '17 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.