> Could linux write everything to a file every 30 seconds. A bit like a keylogger

yes, but probably not a good idea?