Chapter 3. Playing back recorded sessions

You can use the tlog-play tool to play back session recordings in a terminal. The tlog-play tool is a playback program for terminal input and output recorded with the tlog-rec tool. It reproduces the recording of the terminal it is under, but cannot change its size. For this reason the playback terminal needs to match the recorded terminal size for proper playback. The tlog-play tool loads its parameters from the /etc/tlog/tlog-play.conf configuration file. You can override those parameters with command line options described in the tlog-play manual pages.

The RHEL 8 web console has a whole interface for managing recorded sessions. You can choose the session you want to review directly from the Session Recording page, where the list of your recorded session is.

Example 3.1. Example list of recorded sessions

The web console player supports window resizing.

You can play back session recordings from exported log files or from the Systemd Journal.

tlog-play --reader=file --file-path=tlog.log

# tlog-play --reader=file --file-path=tlog.log

In practice however, playback from Journal is usually done with a single match against the TLOG_REC Journal field. The TLOG_REC field contains a copy of the rec field from the logged JSON data, which is a host-unique ID of the recording.

You can take the ID either from the TLOG_REC field value directly, or from the MESSAGE field from the JSON rec field. Both fields are part of log messages coming from the tlog-rec-session tool.

tlog-play -r journal -M TLOG_REC=<your-unique-host-id>

# tlog-play -r journal -M TLOG_REC=<your-unique-host-id>

You can find further instructions and documentation in the tlog-play manual pages.