execsnoop.c -l option matches comm rather than arguments
Author: chewiCreated Mar 5, 2026Updated Mar 5, 2026
The --help text for execsnoop.c says:
-l, --line=LINE only print commands where arg contains this lineBut in practise, it actually compares this against comm like the --name option does. execsnoop.py works as expected here, so I'm guessing this wasn't intentional.
Source: iovisor/bcc