1tlog-play(8) System Manager's Manual tlog-play(8)
2
6 tlog-play - play back terminal I/O recorded by tlog-rec(8)
7
10 tlog-play [OPTION...]
11
14 Tlog-play is a playback program for terminal I/O recorded with tlog-
15 rec(8). It reproduces the recording on the terminal it's run under,
16 and can't change its size, so the playback terminal size needs to match
17 the recorded terminal size for proper playback.
18 Tlog-play loads its parameters from the system-wide configuration file
20 /etc/tlog/tlog-play.conf, which can be overridden with command-line op‐
21 tions described below.
22
25 General options
26 -h, --help
27 Output a command-line usage message and exit.
28 -v, --version
33 Output version information and exit.
34 --configuration
39 Output program configuration in JSON and exit.
40 -s, --speed=NUMBER
45 Set playback speed multiplier to NUMBER.
46 NUMBER is a floating-point number to multiply playback speed by.
48 Can be adjusted during playback.
49 Value minimum: 0
51 -f, --follow
53 Wait for and play back new messages.
54 If specified, when the end of the recorded session is reached,
56 wait for new messages to be added and play them back when they
57 appear.
58 -g, --goto=STRING
61 Fast-forward to STRING time (start/end/HH:MM:SS.sss).
62 STRING is a logical location, or a time to which recording
64 should be fast-forwarded. Can be a "start", or an "end" string,
65 or a timestamp formatted as HH:MM:SS.sss, where any part can be
66 omitted to mean zero.
67 -p, --paused
70 Start playback paused.
71 If specified, playback is started in a paused state.
73 -r, --reader=STRING
76 Use STRING log reader (file/journal/es, default file).
77 STRING is the type of "log reader" to use for retrieving log
79 messages. The chosen reader needs to be configured using its own
80 dedicated parameters.
81 Value should be one of: "file", "journal", "es"
83 --persist
85 Ignore quit key and signals from keyboard.
86 If specified, ignore any keyboard-generated signals and the quit
88 key.
89 --lax Ignore missing (dropped) log messages.
92 If specified, ignore missing (dropped, or lost) log messages.
94 Otherwise report an error and abort when a message is missing.
95 File reader options
98 -i, --file-path=FILE
99 Read log from FILE file.
100 FILE is the path to the file the "file" reader should read logs
102 from.
103 -m, --file-match=STRING
106 Playback explicit recording id specified in STRING.
107 STRING is the recording id of the recording the "file" reader
109 should seek to for playback.
110 Elasticsearch reader options
113 --es-baseurl=STRING
114 Elasticsearch URL without query or fragment parts.
115 STRING is the base URL to request Elasticsearch through. Should
117 not contain query (?...) or fragment (#...) parts.
118 --es-query=STRING
121 Elasticsearch query.
122 STRING is the query string to send to Elasticsearch
124 --es-verbose
127 Enable verbose output on Elasticsearch HTTP client.
128 If specified, enable verbose output on Elasticsearch HTTP
130 client.
131 Systemd journal reader options
134 -S, --journal-since=SECONDS
135 Start searching journal at SECONDS since epoch.
136 SECONDS is the number of seconds since epoch to seek to before
138 searching for the first matching log entry.
139 Value minimum: 0
141 -U, --journal-until=SECONDS
143 Stop searching journal at SECONDS since epoch.
144 SECONDS is the number of seconds since epoch at which searching
146 for log entries should stop.
147 Value minimum: 0
149 -M, --journal-match=STRING
151 Add STRING to journal match symbol list.
152 Each STRING specifies a journal match symbol: either a name-
154 value pair, according to sd_journal_add_match(3), or an "OR" or
155 "AND" string signifying disjunction or conjunction, as with
156 sd_journal_add_disjunction(3) and sd_journal_add_conjunction(3)
157 -N, --journal-namespace=STRING
160 Search for the records in STRING namespace only.
161 STRING is the Specifies a specific journal namespace to use.
163
168 Playback can be controlled using the following keys:
169 SPACE, p
172 Pause/resume playback.
173 } Double the playback speed. Maximum is 16x.
176 { Halve the playback speed. Minimum is 1/16x.
179 BACKSPACE
182 Reset playback to normal, 1x speed.
183 . Output the next packet immediately, without delay, regardless if
186 paused or not. Press when paused to step through recording.
187 Press once to skip a long pause. Hold to skip through recording
188 at constant speed (the keyboard repeat rate).
189 G Fast-forward the recording to the end, or to specified time.
192 Works while playing and on pause. The time can be specified by
193 typing in a timestamp before pressing 'G'. The timestamp should
194 follow the format of the -g/--goto option value, but without the
195 fractions of a second. The command has no effect, if the speci‐
196 fied time location has already been reached.
197 E.g. pressing just 'G' would fast-forward to the end, which is
199 useful with following enabled. Pressing '3', '0', 'G' (typing
200 "30G") would fast-forward to 30 seconds from the start of the
201 recording. Typing "30:00G" would fast-forward to 30 minutes, and
202 so would "30:G", and "1800G". Typing "2::G" would fast-forward
203 to two hours into the recording, the same as "120:G" and
204 "7200G".
205 q Stop playing and quit.
208
211 /etc/tlog/tlog-play.conf
212 The system-wide configuration file
213
216 Recordings can include control sequences attempting to communicate with
217 the terminal, and the playback terminal would dutifully reply to them.
218 Tlog-play tries to filter these responses out, but since it's not a
219 full terminal emulator itself, and since there's a great variety of
220 such control sequences, it can sometimes fail, and interpret some of
221 these as playback control keys described above, with corresponding ef‐
222 fects.
223 This is going to be fixed in future releases, possibly by embedding a
225 proper terminal emulator in tlog-play. For now, most recordings would
226 reproduce correctly, but some might exhibit erratic behavior, and it is
227 possible to e.g. make a recording which would skip (hide) a part of it‐
228 self on playback. However, there are other, easier ways to hide actions
229 on a terminal, of course.
230
233 Play back contents of a file written with tlog-rec's "file" writer:
234 tlog-play -r file --file-path=recording.log
235 Play back a recording from Journal:
238 tlog-play -r journal -M
239 TLOG_REC=6071524bb44d403991a00413ab7c8596-53bd-378c5d9
240 Play back a recording from Elasticsearch:
243 tlog-play -r es --es-baseurl=http://local‐
244 host:9200/tlog/tlog/_search --es-query=session:121
245
248 tlog-play.conf(5), tlog-rec(8)
249
252 Nikolai Kondrashov <spbnick@gmail.com>
253Tlog March 2016 tlog-play(8)