The --help text for execsnoop.c says:
-l, --line=LINE only print commands where arg contains this line
But in practise, it actually compares this against comm like the --name option does. execsnoop.py works as expected here, so I'm guessing this wasn't intentional.
The
--helptext for execsnoop.c says:But in practise, it actually compares this against
commlike the--nameoption does. execsnoop.py works as expected here, so I'm guessing this wasn't intentional.