+ test_success "--condition event-rule-matches one syscall:entry" \
+ --condition event-rule-matches --domain=kernel --type=syscall:entry --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one syscall:exit" \
+ --condition event-rule-matches --domain=kernel --type=syscall:exit --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one syscall:entry-exit" \
+ --condition event-rule-matches --domain=kernel --type=syscall:entry+exit --name=open \
+ --action notify