Chapter 3. Playing back recorded sessions

There are two possibilities for replaying already recorded sessions. The first one is to use the tlog-play tool. The second option is to manage your recorded sessions from the RHEL 8 web console, also referred to as Cockpit.

3.1. Playback with the web console

The RHEL 8 web console has a whole interface for managing recorded sessions. You can choose the session you want to review directly from the Session Recording page, where the list of your recorded session is.

Example 3.1. Example list of recorded sessions

List of recorded sessions

The web console player supports window resizing.

3.2. Playback with tlog-play

Other option for playback of recorded sessions is using the tlog-play tool. The tlog-play tool is a playback program for terminal input and output recorded with the tlog-rec tool. It reproduces the recording of the terminal it is under, but cannot change its size. For this reason the playback terminal needs to match the recorded terminal size for proper playback. The tlog-play tool loads its parameters from the /etc/tlog/tlog-play.conf configuration file. The parameters can be overriden with command line options described in the tlog-play manual pages.

3.3. Playing back recorded sessions with tlog-play

Recorded sessions can be played back either from a simple file or from Systemd Journal.

Playing back from a file

You can play a session back from a file both during and after recording: 

# tlog-play --reader=file --file-path=tlog.log

Playing back from Journal

Generally, you can select Journal log entries for playback using Journal matches and timestamp limits, with the -M or --journal-match, -S or --journal-since, and -U or --journal-until options.

In practice however, playback from Journal is usually done with a single match against the TLOG_REC Journal field. The TLOG_REC field contains a copy of the rec field from the logged JSON data, which is a host-unique ID of the recording.

You can take the ID either from the TLOG_REC field value directly, or from the MESSAGE field from the JSON rec field. Both fields are part of log messages coming from the tlog-rec-session tool.

Procedure

  1. You can play back the whole recording as follows: 
# tlog-play -r journal -M TLOG_REC=<your-unique-host-id>

You can find further instructions and documentation in the tlog-play manual pages.