moved quoting below argument pattern match, so that the pattern match…

… happens on the unquoted argument
mwesolowski · Apr 8, 2018 · 9345df1 · 9345df1
1 parent 79ce51c
commit 9345df1
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/tools/execsnoop.py b/tools/execsnoop.py
@@ -195,14 +195,14 @@ def print_event(cpu, data, size):
  skip = True
  if args.name and not re.search(bytes(args.name), event.comm):
  skip = True
+ if args.line and not re.search(bytes(args.line),
+ b' '.join(argv[event.pid])):
+ skip = True
  if args.quote:
  argv[event.pid] = [
  "\"" + arg.replace("\"", "\\\"") + "\""
  for arg in argv[event.pid]
  ]
- if args.line and not re.search(bytes(args.line),
- b' '.join(argv[event.pid])):
- skip = True
 
  if not skip:
  if args.timestamp: