Added -q option to the USAGE string in execsnoop. Added -q option to …

…the manpage for execsnoop
GaoHuijian · Apr 8, 2018 · 059ff55 · 059ff55
1 parent 9345df1
commit 059ff55
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/man/man8/execsnoop.8 b/man/man8/execsnoop.8
@@ -30,6 +30,10 @@ Include a timestamp column.
 \-x
 Include failed exec()s
 .TP
+\-q
+Add "quotemarks" around arguments. Escape quotemarks in arguments with a
+backslash. For tracing empty arguments or arguments that contain whitespace. 
+.TP
 \-n NAME
 Only print command lines matching this name (regex)
 .TP
@@ -52,6 +56,10 @@ Include failed exec()s:
 #
 .B execsnoop \-x
 .TP
+Put quotemarks around arguments. 
+#
+.B execsnoop \-q
+.TP
 Only trace exec()s where the filename contains "mount":
 #
 .B execsnoop \-n mount

diff --git a/tools/execsnoop.py b/tools/execsnoop.py
@@ -31,6 +31,7 @@
  ./execsnoop # trace all exec() syscalls
  ./execsnoop -x # include failed exec()s
  ./execsnoop -t # include timestamps
+ ./execsnoop -q # add "quotemarks" around arguments
  ./execsnoop -n main # only print command lines containing "main"
  ./execsnoop -l tpkg # only print command where arguments contains "tpkg"
 """