How to Record and Replay Terminal Sessions in Linux Using script and scriptreplay

Auditing complex system administration tasks, recording software compilation steps, providing technical compliance logs, and demonstrating terminal workflows to students or colleagues frequently requires capturing live shell activity. While basic shell output redirection (such as command > output.log 2>&1 or tee) captures standard text streams, it fails to record interactive curses programs (like nano, top, or htop), misses ANSI colour formatting, and loses the exact timing between command keystrokes.

Fortunately, virtually every modern Linux distribution includes two standard, lightweight core utilities from the util-linux package engineered specifically for interactive terminal logging: script and scriptreplay. The script command spawns a pseudo-terminal (pty) to record every keystroke, escape sequence, colour code, and character printed to your screen. Meanwhile, scriptreplay parses the timing metadata file to replay the recorded session in real time, simulating live typing directly inside any terminal window. This guide walks you through recording shell sessions, capturing precise timing files, replaying interactive logs at custom playback speeds, and integrating session recordings into compliance audits.

Why script and scriptreplay Outperform Standard Shell Logging

Before launching a session recording, understanding the architectural benefits of pseudo-terminal capture demonstrates why script is superior to plain text logging:

• Captures Full Interactive PTY Sessions: Traditional pipes and redirects break interactive menus that require terminal raw mode (such as aptitude, fdisk, or text editors). Because script operates via a real pseudo-terminal, everything functions identically to a normal interactive shell.
• Preserves Exact Keystroke Timings: By recording microsecond-level timing metadata in a companion timing file, scriptreplay can reproduce pauses, deliberate keystrokes, and output bursts exactly as they occurred during the live session.
• Zero Dependencies: Both utilities are installed by default on Debian, Ubuntu, Fedora, RHEL, CentOS, Arch Linux, and Alpine, requiring no third-party package installations, Python runtimes, or external recording daemons.
• Compliance and Security Auditing: System administrators can log maintenance windows on production servers, providing an indisputable, immutable record of every command executed and its corresponding system response. When maintaining strict security parity across configuration scripts, explore how to copy file permissions and ownership in Linux using chmod and chown reference flags.

Recording a Terminal Session with Precise Timing Metadata

To record both the terminal output and the timing file required for real-time playback, invoke script with the -t (timing) parameter:

script --timing=timing.log session.log

Upon pressing Enter, the utility prints a confirmation notice:

Script started, file is session.log
Script started, timing file is timing.log

From this moment onward, conduct your administrative tasks normally. Every command you execute, output table rendered, and typo corrected is written to session.log, while character intervals are recorded in timing.log.

To end the recording session, simply type exit or press Ctrl + D. The terminal will output:

Script done, file is session.log
Script done, timing file is timing.log

Replaying Recorded Terminal Sessions in Real Time

Once you have captured your session and timing files, you can replay the entire sequence using scriptreplay:

scriptreplay --timing=timing.log session.log

The terminal immediately clears and begins playing back your exact keystrokes, complete with cursor movements, text editing pauses, command execution times, and ANSI colour rendering. It looks identical to watching a live administrator type at the keyboard.

Adjusting Replay Playback Speed

If the original recording contains lengthy pauses while the operator read documentation or waited for large file transfers, you can accelerate or decelerate playback using the -d (divisor) or -m (max delay) parameters:

• Double Playback Speed: To replay the recording at twice normal speed:

  scriptreplay -d 2 --timing=timing.log session.log

• Quadruple Playback Speed: To watch rapid deployment routines at four times speed:

  scriptreplay -d 4 --timing=timing.log session.log

• Cap Long Pauses: If you waited five minutes for a compilation to finish, you can cap the maximum pause between keystrokes to two seconds using the -m flag:

  scriptreplay -m 2 --timing=timing.log session.log

Logging Terminal Activity in the Background Without Timing

If your goal is simply to generate a textual audit log of commands for archival purposes or to split large session logs for emailing, you can omit the timing file and run script in append mode:

script -a production_maintenance.log

The -a (append) flag ensures that if you start and stop recording multiple times throughout the day, new shell entries are cleanly appended to the existing file rather than overwriting previous logs. When archiving or transferring voluminous system logs, pairing your workflow with our tutorial on how to use the split command in Linux to divide large files prevents storage issues.

Viewing Plain Text Cleaned from ANSI Escape Codes

Because script records raw terminal codes (including terminal cursor positions and colour sequences), opening session.log in simple text editors like nano or cat displays escape sequences (such as ^[[0;32m). To view a clean representation of the recorded text without raw escape characters, use the cat or less -R commands:

less -R session.log

Alternatively, strip non-printable escape sequences into a pristine ASCII file using col -b:

col -b < session.log > session_clean.txt