Record and Replay Every Linux Terminal Action with script & scriptreplay

Linux provides a powerful way to capture an entire terminal session, including exact timestamps for each command, and replay it like a video with adjustable speed.

The two utilities script and scriptreplay are installed by default on most distributions.

Recording a session

script -t 2>time.file -a scriptfile

This command starts recording; time.file stores timing information, while scriptfile stores the commands and their output. Both file names are customizable.

Adding -q runs script in quiet mode, so the user does not see the start/stop messages.

Stop recording with Ctrl+D or by running exit.

Replaying the session

scriptreplay time.file scriptfile

Use the -d (or --divisor) option to change playback speed (e.g., -d 0.1 for slow motion). Some older versions may lack this option.

If real‑time writing is needed, add -f (or --flush) to script so each command is flushed to the file immediately. script -f demo When scriptreplay supports -f, you can replay with live flushing: scriptreplay -f demo Otherwise, monitor the file with tail -f demo.

Running a command non‑interactively

script -qa "file.out" -c "/root/hello.sh"

The -c option executes a command directly, storing its output in file.out.

Automatic logging on login

Insert a script invocation into a shell startup file (e.g., /etc/profile) to record every login session:

# Add automatic logging on login
script -t -f -q 2>/var/log/user_record/$USER-$UID-`date +%Y%m%d%H%M%S`.time -a /var/log/user_record/$USER-$UID-`date +%Y%m%d%H%M%S`.his
if [ "$SHLVL" = 1 ]; then
    exit
fi

After logging in, you can view the live log with tail -f /var/log/user_record/….

Typical use cases

Create tutorial videos that show exact command‑line techniques.

Share a recorded session file so others can follow the exact steps.

Capture fast troubleshooting sessions without needing a screen recorder.

Debug complex shell scripts by replaying the full output.

Audit user activity on a server to identify who performed which actions.

(Not recommended) Attempt to capture passwords—this is insecure and discouraged.