Red Hat Training

A Red Hat training course is available for RHEL 8

Chapter 3. Playing back recorded sessions

There are two methods for replaying recorded sessions:

  • the tlog-play tool
  • the RHEL 8 web console, also referred to as Cockpit.

3.1. Playback with tlog-play

You can use the tlog-play tool to play back session recordings in a terminal. The tlog-play tool is a playback program for terminal input and output recorded with the tlog-rec tool. It reproduces the recording of the terminal it is under, but cannot change its size. For this reason the playback terminal needs to match the recorded terminal size for proper playback. The tlog-play tool loads its parameters from the /etc/tlog/tlog-play.conf configuration file. You can override those parameters with command line options described in the tlog-play manual pages.

3.2. Playback with the web console

The RHEL 8 web console has a whole interface for managing recorded sessions. You can choose the session you want to review directly from the Session Recording page, where the list of your recorded session is.

Example 3.1. Example list of recorded sessions

List of recorded sessions

The web console player supports window resizing.

3.3. Playing back recorded sessions with tlog-play

You can play back session recordings from exported log files or from the Systemd Journal.

Playing back from a file

You can play a session back from a file both during and after recording: 

# tlog-play --reader=file --file-path=tlog.log

Playing back from the Journal

Generally, you can select Journal log entries for playback using Journal matches and timestamp limits, with the -M or --journal-match, -S or --journal-since, and -U or --journal-until options.

In practice however, playback from Journal is usually done with a single match against the TLOG_REC Journal field. The TLOG_REC field contains a copy of the rec field from the logged JSON data, which is a host-unique ID of the recording.

You can take the ID either from the TLOG_REC field value directly, or from the MESSAGE field from the JSON rec field. Both fields are part of log messages coming from the tlog-rec-session tool.

Procedure

  1. You can play back the whole recording as follows: 
# tlog-play -r journal -M TLOG_REC=<your-unique-host-id>

You can find further instructions and documentation in the tlog-play manual pages.