在 Linux 上记录和重放终端会话活动
记录
通常，Linux 管理员们都使用 `history` 命令来跟踪在先前的会话中执行过哪些命令，但是 `history` 命令的局限性在于它不存储命令的输出。在某些情况下，我们要检查上一个会话的命令输出，并希望将其与当前会话进行比较。除此之外，在某些情况下，我们正在对 Linux 生产环境中的问题进行故障排除，并希望保存所有终端会话活动以供将来参考，因此在这种情况下，`script` 命令就变得很方便。


![](/data/attachment/album/201910/06/122659mmi64z8ryr4z2n8a.jpg)


`script` 是一个命令行工具，用于捕获/记录你的 Linux 服务器终端会话活动，以后可以使用 `scriptreplay` 命令重放记录的会话。在本文中，我们将演示如何安装 `script` 命令行工具以及如何记录 Linux 服务器终端会话活动，然后，我们将看到如何使用 `scriptreplay` 命令来重放记录的会话。


### 安装 script 工具


#### 在 RHEL 7/ CentOS 7 上安装 script 工具


`script` 命令由 RPM 包 `util-linux` 提供，如果你没有在你的 CentOS 7 / RHEL 7 系统上安装它，运行下面的 `yum` 安装它：



```
[root@linuxtechi ~]# yum install util-linux -y
```

#### 在 RHEL 8 / CentOS 8 上安装 script 工具


运行下面的 `dnf` 命令来在 RHEL 8 / CentOS 8 上安装 `script` 工具：



```
[root@linuxtechi ~]# dnf install util-linux -y
```

#### 在基于 Debian 的系统（Ubuntu / Linux Mint）上安装 script 工具


运行下面的 `apt-get` 命令来安装 `script` 工具：



```
root@linuxtechi ~]# apt-get install util-linux -y
```

### 如何使用 script 工具


直接使用 `script` 命令，在终端上键入 `script` 命令，然后按回车，它将开始在名为 `typescript` 的文件中捕获当前的终端会话活动。



```
[root@linuxtechi ~]# script
Script started, file is typescript
[root@linuxtechi ~]#
```

要停止记录会话活动，请键入 `exit` 命令，然后按回车：



```
[root@linuxtechi ~]# exit
exit
Script done, file is typescript
[root@linuxtechi ~]#
```

`script` 命令的语法格式：



```
~] # script {options}  {file_name}
```

能在 `script` 命令中使用的不同选项：


![options-script-command](/data/attachment/album/201910/06/122713o4vvjz6xmxljc4vd.png)


让我们开始通过执行 `script` 命令来记录 Linux 终端会话，然后执行诸如 `w`，`route -n`，`df -h` 和 `free -h`，示例如下所示：


![script-examples-linux-server](/data/attachment/album/201910/06/122715ud9bxq9ovq2b0dqa.jpg)


正如我们在上面看到的，终端会话日志保存在文件 `typescript` 中：


现在使用 `cat` / `vi` 命令查看 `typescript` 文件的内容，



```
[root@linuxtechi ~]# ls -l typescript
-rw-r--r--. 1 root root 1861 Jun 21 00:50 typescript
[root@linuxtechi ~]#
```

![typescript-file-content-linux](/data/attachment/album/201910/06/122716y7f166757hfl56fs.jpg)


以上内容确认了我们在终端上执行的所有命令都已保存在 `typescript` 文件中。


### 在 script 命令中使用定制文件名


假设我们要使用自定义文件名来执行 `script` 命令，可以在 `script` 命令后指定文件名。在下面的示例中，我们使用的文件名为 `session-log-(当前日期时间).txt`。



```
[root@linuxtechi ~]# script sessions-log-$(date +%d-%m-%Y-%T).txt
Script started, file is sessions-log-21-06-2019-01:37:39.txt
[root@linuxtechi ~]#
```

现在运行该命令并输入 `exit`：



```
[root@linuxtechi ~]# exit
exit
Script done, file is sessions-log-21-06-2019-01:37:39.txt
[root@linuxtechi ~]#
```

### 附加命令输出到 script 记录文件


假设 `script` 命令已经将命令输出记录到名为 `session-log.txt` 的文件中，现在我们想将新会话命令的输出附加到该文件中，那么可以在 `script` 命令中使用 `-a` 选项。



```
[root@linuxtechi ~]# script -a sessions-log.txt
Script started, file is sessions-log.txt
[root@linuxtechi ~]# xfs_info /dev/mapper/centos-root
meta-data=/dev/mapper/centos-root isize=512    agcount=4, agsize=2746624 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=0 spinodes=0
data     =                       bsize=4096   blocks=10986496, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
log      =internal               bsize=4096   blocks=5364, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
[root@linuxtechi ~]# exit
exit
Script done, file is sessions-log.txt
[root@linuxtechi ~]#
```

要查看更新的会话记录，使用 `cat session-log.txt` 命令。


### 无需 shell 交互而捕获命令输出到 script 记录文件


假设我们要捕获命令的输出到会话记录文件，那么使用 `-c` 选项，示例如下所示：



```
[root@linuxtechi ~]# script -c "uptime && hostname && date" root-session.txt
Script started, file is root-session.txt
 01:57:40 up  2:30,  3 users,  load average: 0.00, 0.01, 0.05
linuxtechi
Fri Jun 21 01:57:40 EDT 2019
Script done, file is root-session.txt
[root@linuxtechi ~]#
```

### 以静默模式运行 script 命令


要以静默模式运行 `script` 命令，请使用 `-q` 选项，该选项将禁止 `script` 的启动和完成消息，示例如下所示：



```
[root@linuxtechi ~]# script -c "uptime && date" -q root-session.txt
 02:01:10 up  2:33,  3 users,  load average: 0.00, 0.01, 0.05
Fri Jun 21 02:01:10 EDT 2019
[root@linuxtechi ~]#
```

要将时序信息记录到文件中并捕获命令输出到单独的文件中，这可以通过在 `script` 命令中传递时序文件（`-timing`）实现，示例如下所示：


语法格式：



```
~ ]# script -t <timing-file-name>  {file_name}
```


```
[root@linuxtechi ~]# script --timing=timing.txt session.log
Script started, file is session.log
[root@linuxtechi ~]# uptime
 02:27:59 up  3:00,  3 users,  load average: 0.00, 0.01, 0.05
[root@linuxtechi ~]# date
Fri Jun 21 02:28:02 EDT 2019
[root@linuxtechi ~]# free -h
              total        used        free      shared  buff/cache   available
Mem:           3.9G        171M        2.0G        8.6M        1.7G        3.3G
Swap:          3.9G          0B        3.9G
[root@linuxtechi ~]# whoami
root
[root@linuxtechi ~]# exit
exit
Script done, file is session.log
[root@linuxtechi ~]#
[root@linuxtechi ~]# ls -l session.log timing.txt
-rw-r--r--. 1 root root 673 Jun 21 02:28 session.log
-rw-r--r--. 1 root root 414 Jun 21 02:28 timing.txt
[root@linuxtechi ~]#
```

### 重放记录的 Linux 终端会话活动


现在，使用 `scriptreplay` 命令重放录制的终端会话活动。


注意：`scriptreplay` 也由 RPM 包 `util-linux` 提供。`scriptreplay` 命令需要时序文件才能工作。



```
[root@linuxtechi ~]# scriptreplay --timing=timing.txt session.log
```

上面命令的输出将如下所示，


![](/data/attachment/album/201910/06/122718q7riaibd8a7rr8r7.gif)


### 记录所有用户的 Linux 终端会话活动


在某些关键业务的 Linux 服务器上，我们希望跟踪所有用户的活动，这可以使用 `script` 命令来完成，将以下内容放在 `/etc/profile` 文件中，



```
[root@linuxtechi ~]# vi /etc/profile
……………………………………………………
if [ "x$SESSION_RECORD" = "x" ]
then
timestamp=$(date +%d-%m-%Y-%T)
session_log=/var/log/session/session.$USER.$$.$timestamp
SESSION_RECORD=started
export SESSION_RECORD
script -t -f -q 2>${session_log}.timing $session_log
exit
fi
……………………………………………………
```

保存文件并退出。


在 `/var/log` 文件夹下创建 `session` 目录：



```
[root@linuxtechi ~]# mkdir /var/log/session
```

给该文件夹指定权限：



```
[root@linuxtechi ~]# chmod 777 /var/log/session/
[root@linuxtechi ~]#
```

现在，验证以上代码是否有效。在我正在使用 `pkumar` 用户的情况下，登录普通用户到 Linux 服务器：



```
~ ] # ssh root@linuxtechi
root@linuxtechi's password:
[root@linuxtechi ~]$ uptime
 04:34:09 up  5:06,  3 users,  load average: 0.00, 0.01, 0.05
[root@linuxtechi ~]$ date
Fri Jun 21 04:34:11 EDT 2019
[root@linuxtechi ~]$ free -h
              total        used        free      shared  buff/cache   available
Mem:           3.9G        172M        2.0G        8.6M        1.7G        3.3G
Swap:          3.9G          0B        3.9G
[root@linuxtechi ~]$ id
uid=1001(pkumar) gid=1002(pkumar) groups=1002(pkumar) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[root@linuxtechi ~]$ whoami
pkumar
[root@linuxtechi ~]$ exit

Login as root and view user’s linux terminal session activity

[root@linuxtechi ~]# cd /var/log/session/
[root@linuxtechi session]# ls -l | grep pkumar
-rw-rw-r--. 1 pkumar pkumar 870 Jun 21 04:34 session.pkumar.19785.21-06-2019-04:34:05
-rw-rw-r--. 1 pkumar pkumar 494 Jun 21 04:34 session.pkumar.19785.21-06-2019-04:34:05.timing
[root@linuxtechi session]#
```

![Session-output-file-linux](/data/attachment/album/201910/06/122719dexuklun2x9kx2lf.jpg)


我们还可以使用 `scriptreplay` 命令来重放用户的终端会话活动：



```
[root@linuxtechi session]# scriptreplay --timing session.pkumar.19785.21-06-2019-04\:34\:05.timing session.pkumar.19785.21-06-2019-04\:34\:05
```

以上就是本教程的全部内容，请在下面的评论部分中分享你的反馈和评论。




---


via: <https://www.linuxtechi.com/record-replay-linux-terminal-sessions-activity/>


作者：[Pradeep Kumar](https://www.linuxtechi.com/author/pradeep/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[wxy](https://github.com/wxy) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Generally, all Linux administrators use **history** command to track which commands were executed in previous sessions, but there is one limitation of history command is that it doesn’t store the command’s output. There can be some scenarios where we want to check commands output of previous session and want to compare it with current session. Apart from this, there are some situations where we are troubleshooting the issues on Linux production boxes and want to save all terminal session activities for future reference, so in such cases script command become handy.

Script is a command line tool which is used to capture or record your Linux server terminal sessions activity and later the recorded session can be replayed using scriptreplay command. In this article we will demonstrate how to install script command line tool and how to record Linux server terminal session activity and then later we will see how the recorded session can be replayed using **scriptreplay** command.

#### Installation of Script tool on RHEL 7/ CentOS 7

Script command is provided by the rpm package “**util-linux**”, in case it is not installed on your CentOS 7 / RHEL 7 system , run the following yum command,

[root@linuxtechi ~]# yum install util-linux -y

**On RHEL 8 / CentOS 8**

Run the following dnf command to install script utility on RHEL 8 and CentOS 8 system,

[root@linuxtechi-rhel8 ~]# dnf install util-linux -y

**Installation of Script tool on Debian based systems (Ubuntu / Linux Mint)**

Execute the beneath apt-get command to install script utility

root@linuxtechi ~]# apt-get install util-linux -y

#### How to Use script utility

Use of script command is straight forward, type script command on terminal then hit enter, it will start capturing your current terminal session activities inside a file called “**typescript**”

[root@linuxtechi ~]# script Script started, file is typescript [root@linuxtechi ~]#

To stop recording the session activities, type exit command and hit enter.

[root@linuxtechi ~]# exit exit Script done, file is typescript [root@linuxtechi ~]#

Syntax of Script command:

~ ] # script {options} {file_name}

Different options used in script command,

Let’s start recording of your Linux terminal session by executing script command and then execute couple of command like ‘**w**’, ‘**route -n**’ , ‘[ df -h](https://www.linuxtechi.com/11-df-command-examples-in-linux/)’ and ‘

**free-h**’, example is shown below

As we can see above, terminal session logs are saved in the file “typescript”

Now view the contents of typescript file using [cat](https://www.linuxtechi.com/cat-command-examples-for-beginners-in-linux/) / vi command,

[root@linuxtechi ~]# ls -l typescript -rw-r--r--. 1 root root 1861 Jun 21 00:50 typescript [root@linuxtechi ~]#

Above confirms that whatever commands we execute on terminal that have been saved inside the file “typescript”

#### Use Custom File name in script command

Let’s assume we want to use our customize file name to script command, so specify the file name after script command, in the below example we are using a file name “session-log-(current-date-time).txt”

[root@linuxtechi ~]# script sessions-log-$(date +%d-%m-%Y-%T).txt Script started, file is sessions-log-21-06-2019-01:37:39.txt [root@linuxtechi ~]#

Now run the commands and then type exit,

[root@linuxtechi ~]# exit exit Script done, file is sessions-log-21-06-2019-01:37:39.txt [root@linuxtechi ~]#

#### Append the commands output to script file

Let assume script command had already recorded the commands output to a file called session-log.txt file and now we want to append output of new sessions commands output to this file, then use “**-a**” command in script command

[root@linuxtechi ~]# script -a sessions-log.txt Script started, file is sessions-log.txt [root@linuxtechi ~]# xfs_info /dev/mapper/centos-root meta-data=/dev/mapper/centos-root isize=512 agcount=4, agsize=2746624 blks = sectsz=512 attr=2, projid32bit=1 = crc=1 finobt=0 spinodes=0 data = bsize=4096 blocks=10986496, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0 ftype=1 log =internal bsize=4096 blocks=5364, version=2 = sectsz=512 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 [root@linuxtechi ~]# exit exit Script done, file is sessions-log.txt [root@linuxtechi ~]#

To view updated session’s logs, use “cat session-log.txt ”

#### Capture commands output to script file without interactive shell

Let’s assume we want to capture commands output to a script file, then use **-c** option, example is shown below,

[root@linuxtechi ~]# script -c "uptime && hostname && date" root-session.txt Script started, file is root-session.txt 01:57:40 up 2:30, 3 users, load average: 0.00, 0.01, 0.05 linuxtechi Fri Jun 21 01:57:40 EDT 2019 Script done, file is root-session.txt [root@linuxtechi ~]#

#### Run script command in quiet mode

To run script command in quiet mode use **-q** option, this option will suppress the script started and script done message, example is shown below,

[root@linuxtechi ~]# script -c "uptime && date" -q root-session.txt 02:01:10 up 2:33, 3 users, load average: 0.00, 0.01, 0.05 Fri Jun 21 02:01:10 EDT 2019 [root@linuxtechi ~]#

Record Timing information to a file and capture commands output to a separate file, this can be achieved in script command by passing timing file (**–timing**) , example is shown below,

Syntax:

~ ]# script -t <timing-file-name> {file_name}

[root@linuxtechi ~]# script --timing=timing.txt session.log Script started, file is session.log [root@linuxtechi ~]# uptime 02:27:59 up 3:00, 3 users, load average: 0.00, 0.01, 0.05 [root@linuxtechi ~]# date Fri Jun 21 02:28:02 EDT 2019 [root@linuxtechi ~]# free -h total used free shared buff/cache available Mem: 3.9G 171M 2.0G 8.6M 1.7G 3.3G Swap: 3.9G 0B 3.9G [root@linuxtechi ~]# whoami root [root@linuxtechi ~]# exit exit Script done, file is session.log [root@linuxtechi ~]# [root@linuxtechi ~]# ls -l session.log timing.txt -rw-r--r--. 1 root root 673 Jun 21 02:28 session.log -rw-r--r--. 1 root root 414 Jun 21 02:28 timing.txt [root@linuxtechi ~]#

#### Replay recorded Linux terminal session activity

Now replay the recorded terminal session activities using scriptreplay command,

**Note:** Scriptreplay is also provided by rpm package “**util-linux**”. Scriptreplay command requires timing file to work.

[root@linuxtechi ~]# scriptreplay --timing=timing.txt session.log

Output of above command would be something like below,

#### Record all User’s Linux terminal session activities

There are some business critical Linux servers where we want keep track on all users activity, so this can be accomplished using script command, place the following content in /etc/profile file ,

[root@linuxtechi ~]# vi /etc/profile …………………………………………………… if [ "x$SESSION_RECORD" = "x" ] then timestamp=$(date +%d-%m-%Y-%T) session_log=/var/log/session/session.$USER.$$.$timestamp SESSION_RECORD=started export SESSION_RECORD script -t -f -q 2>${session_log}.timing $session_log exit fi ……………………………………………………

Save & exit the file.

Create the session directory under /var/log folder,

[root@linuxtechi ~]# mkdir /var/log/session

Assign the permissions to session folder,

[root@linuxtechi ~]# chmod 777 /var/log/session/ [root@linuxtechi ~]#

Now verify whether above code is working or not. Login to ordinary user to linux server, in my I am using pkumar user,

~ ] # ssh[[email protected]][[email protected]]'s password: [pkumar@linuxtechi ~]$ uptime 04:34:09 up 5:06, 3 users, load average: 0.00, 0.01, 0.05 [pkumar@linuxtechi ~]$ date Fri Jun 21 04:34:11 EDT 2019 [pkumar@linuxtechi ~]$ free -h total used free shared buff/cache available Mem: 3.9G 172M 2.0G 8.6M 1.7G 3.3G Swap: 3.9G 0B 3.9G [pkumar@linuxtechi ~]$ id uid=1001(pkumar) gid=1002(pkumar) groups=1002(pkumar) \ context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [pkumar@linuxtechi ~]$ whoami pkumar [pkumar@linuxtechi ~]$ exit

Login as root and view user’s linux terminal session activity [root@linuxtechi ~]# cd /var/log/session/ [root@linuxtechi session]# ls -l | grep pkumar -rw-rw-r--. 1 pkumar pkumar 870 Jun 21 04:34 \ session.pkumar.19785.21-06-2019-04:34:05 -rw-rw-r--. 1 pkumar pkumar 494 Jun 21 04:34 \ session.pkumar.19785.21-06-2019-04:34:05.timing [root@linuxtechi session]#

We can also use scriptreplay command to replay user’s terminal session activities,

[root@linuxtechi session]# scriptreplay --timing \ session.pkumar.19785.21-06-2019-04\:34\:05.timing \ session.pkumar.19785.21-06-2019-04\:34\:05

That’s all from this tutorial, please do share your feedback and comments in the comments section below.

naveenThis is what I was looking for.It will be very helpful for automation.

Is there a way to repeat a subset of commands in a loop Also is there a way to do ssh from there terminal by feeding password

kolberThanks for this.

I have one issue, after applying this. Users’s profile “bash_profile” variables won’t load anymore.

How can I solve this?

RickyxVery nice!

A suggestion:

/var/log/session

should be created before editing the profile.

If you exit from the root session before session folder exists you get:

$ su –

Password:

-bash: /var/log/session/session.root.1705.08-03-2020-13:37:55.timing: File o directory non esistente

…and you can’t be root easily again 😉

jairgreat, well explained and complete! Thx!

linuxadmany idea on how to prevent the user from deleting it own session?.. since the file owner is the user itself and /var/log/session is with world writable permission?..

Jacob Tuz PootThis works fine for ssh sessions, but now I can not use scp to transfer files, I was looking for any solution about it, but… nothing until now, do anyone had the same issue? how did you solve it?

JaericoCan we include the info about who sshed my server in this thing ?

Pardom Me , If anything is wrong, I am new to Linux.