1tlog-play(8) System Manager's Manual tlog-play(8)
2
6 tlog-play - play back terminal I/O recorded by tlog-rec(8)
7
10 tlog-play [OPTION...]
11
14 Tlog-play is a playback program for terminal I/O recorded with tlog-
15 rec(8). It reproduces the recording on the terminal it's run under,
16 and can't change its size, so the playback terminal size needs to match
17 the recorded terminal size for proper playback.
18 Tlog-play loads its parameters from the system-wide configuration file
20 /etc/tlog/tlog-play.conf, which can be overridden with command-line
21 options described below.
22
25 General options
26 -h, --help
27 Output a command-line usage message and exit.
28 -v, --version
33 Output version information and exit.
34 --configuration
39 Output program configuration in JSON and exit.
40 -s, --speed=NUMBER
45 Set playback speed multiplier to NUMBER.
46 NUMBER is a floating-point number to multiply playback speed by.
48 Can be adjusted during playback.
49 Value minimum: 0
51 -f, --follow
53 Wait for and play back new messages.
54 If specified, when the end of the recorded session is reached,
56 wait for new messages to be added and play them back when they
57 appear.
58 -g, --goto=STRING
61 Fast-forward to STRING time (start/end/HH:MM:SS.sss).
62 STRING is a logical location, or a time to which recording
64 should be fast-forwarded. Can be a "start", or an "end" string,
65 or a timestamp formatted as HH:MM:SS.sss, where any part can be
66 omitted to mean zero.
67 -p, --paused
70 Start playback paused.
71 If specified, playback is started in a paused state.
73 -r, --reader=STRING
76 Use STRING log reader (file/journal/es, default file).
77 STRING is the type of "log reader" to use for retrieving log
79 messages. The chosen reader needs to be configured using its own
80 dedicated parameters.
81 Value should be one of: "file", "journal", "es"
83 --persist
85 Ignore quit key and signals from keyboard.
86 If specified, ignore any keyboard-generated signals and the quit
88 key.
89 --lax Ignore missing (dropped) log messages.
92 If specified, ignore missing (dropped, or lost) log messages.
94 Otherwise report an error and abort when a message is missing.
95 File reader options
98 -i, --file-path=FILE
99 Read log from FILE file.
100 FILE is the path to the file the "file" reader should read logs
102 from.
103 -m, --file-match=STRING
106 Playback explicit recording id specified in STRING.
107 STRING is the recording id of the recording the "file" reader
109 should seek to for playback.
110 Elasticsearch reader options
113 --es-baseurl=STRING
114 Elasticsearch URL without query or fragment parts.
115 STRING is the base URL to request Elasticsearch through. Should
117 not contain query (?...) or fragment (#...) parts.
118 --es-query=STRING
121 Elasticsearch query.
122 STRING is the query string to send to Elasticsearch
124 --es-verbose
127 Enable verbose output on Elasticsearch HTTP client.
128 If specified, enable verbose output on Elasticsearch HTTP
130 client.
131 Systemd journal reader options
134 -S, --journal-since=SECONDS
135 Start searching journal at SECONDS since epoch.
136 SECONDS is the number of seconds since epoch to seek to before
138 searching for the first matching log entry.
139 Value minimum: 0
141 -U, --journal-until=SECONDS
143 Stop searching journal at SECONDS since epoch.
144 SECONDS is the number of seconds since epoch at which searching
146 for log entries should stop.
147 Value minimum: 0
149 -M, --journal-match=STRING
151 Add STRING to journal match symbol list.
152 Each STRING specifies a journal match symbol: either a name-
154 value pair, according to sd_journal_add_match(3), or an "OR" or
155 "AND" string signifying disjunction or conjunction, as with
156 sd_journal_add_disjunction(3) and sd_journal_add_conjunction(3)
157
162 Playback can be controlled using the following keys:
163 SPACE, p
166 Pause/resume playback.
167 } Double the playback speed. Maximum is 16x.
170 { Halve the playback speed. Minimum is 1/16x.
173 BACKSPACE
176 Reset playback to normal, 1x speed.
177 . Output the next packet immediately, without delay, regardless if
180 paused or not. Press when paused to step through recording.
181 Press once to skip a long pause. Hold to skip through recording
182 at constant speed (the keyboard repeat rate).
183 G Fast-forward the recording to the end, or to specified time.
186 Works while playing and on pause. The time can be specified by
187 typing in a timestamp before pressing 'G'. The timestamp should
188 follow the format of the -g/--goto option value, but without the
189 fractions of a second. The command has no effect, if the speci‐
190 fied time location has already been reached.
191 E.g. pressing just 'G' would fast-forward to the end, which is
193 useful with following enabled. Pressing '3', '0', 'G' (typing
194 "30G") would fast-forward to 30 seconds from the start of the
195 recording. Typing "30:00G" would fast-forward to 30 minutes, and
196 so would "30:G", and "1800G". Typing "2::G" would fast-forward
197 to two hours into the recording, the same as "120:G" and
198 "7200G".
199 q Stop playing and quit.
202
205 /etc/tlog/tlog-play.conf
206 The system-wide configuration file
207
210 Recordings can include control sequences attempting to communicate with
211 the terminal, and the playback terminal would dutifully reply to them.
212 Tlog-play tries to filter these responses out, but since it's not a
213 full terminal emulator itself, and since there's a great variety of
214 such control sequences, it can sometimes fail, and interpret some of
215 these as playback control keys described above, with corresponding
216 effects.
217 This is going to be fixed in future releases, possibly by embedding a
219 proper terminal emulator in tlog-play. For now, most recordings would
220 reproduce correctly, but some might exhibit erratic behavior, and it is
221 possible to e.g. make a recording which would skip (hide) a part of
222 itself on playback. However, there are other, easier ways to hide
223 actions on a terminal, of course.
224
227 Play back contents of a file written with tlog-rec's "file" writer:
228 tlog-play -r file --file-path=recording.log
229 Play back a recording from Journal:
232 tlog-play -r journal -M
233 TLOG_REC=6071524bb44d403991a00413ab7c8596-53bd-378c5d9
234 Play back a recording from Elasticsearch:
237 tlog-play -r es --es-baseurl=http://local‐
238 host:9200/tlog/tlog/_search --es-query=session:121
239
242 tlog-play.conf(5), tlog-rec(8)
243
246 Nikolai Kondrashov <spbnick@gmail.com>
247Tlog March 2016 tlog-play(8)