A key logger can be installed at different levels in the system with different detection ways. You already have other answers that explain that it could be installed in a dedicated process and how to detect its activity.
But it could also be installed by changing the part of the X11 server that processes keyboard inputs. If it is presented as an add-on offering additional capabilities like simpler input on non ascii characters, automatic xxx (put you most expected feature here) it can even be willingly installed by the end user on its own machine. Else, it could be installed (if attacker managed to become root) at boot time through a dedicated init module.
It could also be installed as a kernel module and directly monitor physical keyboard activity. The installation procedures could be identical as previous case.
The only way to secure a system if to always follow all security rules:
- protect it with a strict firewall (easy)
- never use root to do simple tasks (those two first rules are the principle of least priviledge)
- never run any uncontrolled piece of software on it
And the latter is the harder to follow. Of course I assume that you only dowload system software and updates from official sources and do control checksums. But this game or add-on or utility looks so cute... And as soon as someone has made you execute code that he wanted while you would not have, it is no longer your system.
TL/DR: as usual, security cannot be reduced to technological tools but highly depends of human practices...