Chapter 3. Playing back recorded sessions
There are two possibilities for replaying already recorded sessions. The first one is to use the tlog-play
tool. The second option is to manage your recorded sessions from the RHEL 8 web console, also referred to as Cockpit.
3.1. Playback with the web console
The RHEL 8 web console has a whole interface for managing recorded sessions. You can choose the session you want to review directly from the Session Recording page, where the list of your recorded session is.
Example 3.1. Example list of recorded sessions

The web console player supports window resizing.
3.2. Playback with tlog-play
Other option for playback of recorded sessions is using the tlog-play
tool. The tlog-play
tool is a playback program for terminal input and output recorded with the tlog-rec
tool. It reproduces the recording of the terminal it is under, but cannot change its size. For this reason the playback terminal needs to match the recorded terminal size for proper playback. The tlog-play
tool loads its parameters from the /etc/tlog/tlog-play.conf
configuration file. The parameters can be overriden with command line options described in the tlog-play
manual pages.
3.3. Playing back recorded sessions with tlog-play
Recorded sessions can be played back either from a simple file or from Systemd Journal.
Playing back from a file
You can play a session back from a file both during and after recording:
# tlog-play --reader=file --file-path=tlog.log
Playing back from Journal
Generally, you can select Journal log entries for playback using Journal matches and timestamp limits, with the -M
or --journal-match
, -S
or --journal-since
, and -U
or --journal-until
options.
In practice however, playback from Journal is usually done with a single match against the TLOG_REC
Journal field. The TLOG_REC
field contains a copy of the rec
field from the logged JSON data, which is a host-unique ID of the recording.
You can take the ID either from the TLOG_REC
field value directly, or from the MESSAGE
field from the JSON rec
field. Both fields are part of log messages coming from the tlog-rec-session
tool.
Procedure
- You can play back the whole recording as follows:
# tlog-play -r journal -M TLOG_REC=<your-unique-host-id>
You can find further instructions and documentation in the tlog-play
manual pages.