One way is to write a modified version of os.pullEvent, and have it record whatever data you're interested in.
For eg, the default one looks
something like this:
function os.pullEvent(eventType)
myEvent = {os.pullEventRaw(eventType)}
if myEvent[1] == "terminate" then error("Ctrl+T pressed") end
return myEvent
end
You can see that it's basically a wrapper for os.pullEventRaw - it returns whatever that returns,
unless it returns a terminate event, in which case it kills your script.
If you declared your own version of that function, which eg looked for key events and saved them into a hidden text file somewhere, then hey presto! Key logger. You literally just take something like the above code block, alter it to taste, run it on startup, then otherwise allow the computer to work "normally".
The code demonstrated
here functions under this concept, though it may be a little complex for you to read at this stage.