.\" Process this file with .\" groff -man -Tascii .\" .\" Copyright (C) 2016 Red Hat .\" .\" This file is part of tlog. .\" .\" Tlog is free software; you can redistribute it and/or modify .\" it under the terms of the GNU General Public License as published by .\" the Free Software Foundation; either version 2 of the License, or .\" (at your option) any later version. .\" .\" Tlog is distributed in the hope that it will be useful, .\" but WITHOUT ANY WARRANTY; without even the implied warranty of .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the .\" GNU General Public License for more details. .\" .\" You should have received a copy of the GNU General Public License .\" along with tlog; if not, write to the Free Software .\" Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA .\" .TH tlog-play "8" "March 2016" "Tlog" .SH NAME tlog-play \- play back terminal I/O recorded by tlog-rec(8) .SH SYNOPSIS .B tlog-play [OPTION...] .SH DESCRIPTION .B Tlog-play is a playback program for terminal I/O recorded with tlog-rec(8). It reproduces the recording on the terminal it's run under, and can't change its size, so the playback terminal size needs to match the recorded terminal size for proper playback. .B Tlog-play loads its parameters from the system-wide configuration file /etc/tlog/tlog-play.conf, which can be overridden with command-line options described below. .SH OPTIONS .SS General options .TP .B -h, --help Output a command-line usage message and exit. .TP .B -v, --version Output version information and exit. .TP .B --configuration Output program configuration in JSON and exit. .TP .B -s, --speed=NUMBER Set playback speed multiplier to NUMBER. NUMBER is a floating-point number to multiply playback speed by. Can be adjusted during playback. Value minimum: 0 .br .TP .B -f, --follow Wait for and play back new messages. If specified, when the end of the recorded session is reached, wait for new messages to be added and play them back when they appear. .TP .B -g, --goto=STRING Fast-forward to STRING time (start/end/HH:MM:SS.sss). STRING is a logical location, or a time to which recording should be fast-forwarded. Can be a "start", or an "end" string, or a timestamp formatted as HH:MM:SS.sss, where any part can be omitted to mean zero. .TP .B -p, --paused Start playback paused. If specified, playback is started in a paused state. .TP .B -r, --reader=STRING Use STRING log reader (file/journal/es, default file). STRING is the type of "log reader" to use for retrieving log messages. The chosen reader needs to be configured using its own dedicated parameters. Value should be one of: "file", "journal", "es" .br .TP .B --persist Ignore quit key and signals from keyboard. If specified, ignore any keyboard-generated signals and the quit key. .TP .B --lax Ignore missing (dropped) log messages. If specified, ignore missing (dropped, or lost) log messages. Otherwise report an error and abort when a message is missing. .SS File reader options .TP .B -i, --file-path=FILE Read log from FILE file. FILE is the path to the file the "file" reader should read logs from. .TP .B -m, --file-match=STRING Playback explicit recording id specified in STRING. STRING is the recording id of the recording the "file" reader should seek to for playback. .SS Elasticsearch reader options .TP .B --es-baseurl=STRING Elasticsearch URL without query or fragment parts. STRING is the base URL to request Elasticsearch through. Should not contain query (?...) or fragment (#...) parts. .TP .B --es-query=STRING Elasticsearch query. STRING is the query string to send to Elasticsearch .TP .B --es-verbose Enable verbose output on Elasticsearch HTTP client. If specified, enable verbose output on Elasticsearch HTTP client. .SS Systemd journal reader options .TP .B -S, --journal-since=SECONDS Start searching journal at SECONDS since epoch. SECONDS is the number of seconds since epoch to seek to before searching for the first matching log entry. Value minimum: 0 .br .TP .B -U, --journal-until=SECONDS Stop searching journal at SECONDS since epoch. SECONDS is the number of seconds since epoch at which searching for log entries should stop. Value minimum: 0 .br .TP .B -M, --journal-match=STRING Add STRING to journal match symbol list. Each STRING specifies a journal match symbol: either a name-value pair, according to sd_journal_add_match(3), or an "OR" or "AND" string signifying disjunction or conjunction, as with sd_journal_add_disjunction(3) and sd_journal_add_conjunction(3) .TP .B -N, --journal-namespace=STRING Search for the records in STRING namespace only. STRING is the Specifies a specific journal namespace to use. .SH CONTROLS Playback can be controlled using the following keys: .TP .B SPACE, p Pause/resume playback. .TP .B } Double the playback speed. Maximum is 16x. .TP .B { Halve the playback speed. Minimum is 1/16x. .TP .B BACKSPACE Reset playback to normal, 1x speed. .TP .B . Output the next packet immediately, without delay, regardless if paused or not. Press when paused to step through recording. Press once to skip a long pause. Hold to skip through recording at constant speed (the keyboard repeat rate). .TP .B G Fast-forward the recording to the end, or to specified time. Works while playing and on pause. The time can be specified by typing in a timestamp before pressing 'G'. The timestamp should follow the format of the -g/--goto option value, but without the fractions of a second. The command has no effect, if the specified time location has already been reached. E.g. pressing just 'G' would fast-forward to the end, which is useful with following enabled. Pressing '3', '0', 'G' (typing "30G") would fast-forward to 30 seconds from the start of the recording. Typing "30:00G" would fast-forward to 30 minutes, and so would "30:G", and "1800G". Typing "2::G" would fast-forward to two hours into the recording, the same as "120:G" and "7200G". .TP .B q Stop playing and quit. .SH FILES .TP /etc/tlog/tlog-play.conf The system-wide configuration file .SH BUGS Recordings can include control sequences attempting to communicate with the terminal, and the playback terminal would dutifully reply to them. Tlog-play tries to filter these responses out, but since it's not a full terminal emulator itself, and since there's a great variety of such control sequences, it can sometimes fail, and interpret some of these as playback control keys described above, with corresponding effects. This is going to be fixed in future releases, possibly by embedding a proper terminal emulator in tlog-play. For now, most recordings would reproduce correctly, but some might exhibit erratic behavior, and it is possible to e.g. make a recording which would skip (hide) a part of itself on playback. However, there are other, easier ways to hide actions on a terminal, of course. .SH EXAMPLES .TP Play back contents of a file written with tlog-rec's "file" writer: .B tlog-play -r file --file-path=recording.log .TP Play back a recording from Journal: .B tlog-play -r journal -M TLOG_REC=6071524bb44d403991a00413ab7c8596-53bd-378c5d9 .TP Play back a recording from Elasticsearch: .B tlog-play -r es --es-baseurl=http://localhost:9200/tlog/tlog/_search --es-query=session:121 .SH SEE ALSO tlog-play.conf(5), tlog-rec(8) .SH AUTHOR Nikolai Kondrashov