# shellcheck source=../../../utils/utils.sh
source "$TESTDIR/utils/utils.sh"
-plan_tests 174
+plan_tests 297
FULL_LTTNG_BIN="${TESTDIR}/../src/bin/lttng/${LTTNG_BIN}"
# shellcheck disable=SC2119
start_lttng_sessiond_notap
-tmp_stdout=$(mktemp -t test_parse_cli_trigger_stdout.XXXXXX)
-tmp_stderr=$(mktemp -t test_parse_cli_trigger_stderr.XXXXXX)
+tmp_stdout=$(mktemp --tmpdir -t test_parse_cli_trigger_stdout.XXXXXX)
+tmp_stderr=$(mktemp --tmpdir -t test_parse_cli_trigger_stderr.XXXXXX)
uprobe_elf_binary="${TESTDIR}/utils/testapp/userspace-probe-elf-binary/.libs/userspace-probe-elf-binary"
if [ "$(id -u)" == "0" ]; then
shift
diag "${FULL_LTTNG_BIN} add-trigger $*"
+ set -x
"${FULL_LTTNG_BIN}" add-trigger "$@" > "${tmp_stdout}" 2> "${tmp_stderr}"
+ set +x
ok $? "${test_name}: exit code is 0"
diff -u "${tmp_stdout}" <(echo "Trigger registered successfully.")
}
# top-level options
-test_success "explicit id" \
- --id hohoho \
- --condition on-event some-event-id -u \
+test_success "explicit name" \
+ --name hohoho \
+ --condition event-rule-matches --name=some-event-id --domain=user \
--action notify
-# `--condition on-event` successes
-test_success "--condition on-event some-event -u" \
- --condition on-event some-event -u \
+# `--condition event-rule-matches` successes
+test_success "--condition event-rule-matches some-event --domain=user" \
+ --condition event-rule-matches --name=some-event --domain=user \
--action notify
-test_success "--condition on-event -a -u" \
- --condition on-event -a -u \
+test_success "--condition event-rule-matches --domain=user" \
+ --condition event-rule-matches --domain=user \
--action notify
-test_success "--fire-once-after" \
- --condition on-event -u test-fire-once-after \
+test_success "notify action polices" \
+ --condition event-rule-matches --domain=user --name=test-rate-policy \
--action notify \
- --fire-once-after=55
-
-test_success "--fire-every" \
- --condition on-event -u test-fire-every \
+ --rate-policy=every:55 \
--action notify \
- --fire-every=55
+ --rate-policy=once-after:55
+
+test_success "start session action polices" \
+ --condition event-rule-matches --domain=user --name=test-rate-policy \
+ --action start-session my_session \
+ --rate-policy=every:55 \
+ --action start-session my_session \
+ --rate-policy=once-after:55
+
+test_success "stop session action polices" \
+ --condition event-rule-matches --domain=user --name=test-rate-policy \
+ --action stop-session my_session \
+ --rate-policy=every:55 \
+ --action stop-session my_session \
+ --rate-policy=once-after:55
+
+test_success "snapshot session action polices" \
+ --condition event-rule-matches --domain=user --name=test-rate-policy \
+ --action snapshot-session my_session \
+ --rate-policy=every:55 \
+ --action snapshot-session my_session \
+ --rate-policy=once-after:55
+
+test_success "rotate session action polices" \
+ --condition event-rule-matches --domain=user --name=test-rate-policy \
+ --action rotate-session my_session \
+ --rate-policy=every:55 \
+ --action rotate-session my_session \
+ --rate-policy=once-after:55
+
+test_success "--log-level single level" \
+ --condition event-rule-matches --domain=user --log-level=INFO \
+ --action notify
-skip $ist_root "non-root user: skipping kprobe tests" 9 || {
- test_success "--condition on-event probe by symbol" \
- --condition on-event -k --probe=lttng_channel_enable my_channel_enable \
- --action notify
+test_success "--log-level range open max" \
+ --condition event-rule-matches --domain=user --log-level=INFO.. \
+ --action notify
- channel_enable_addr=$(grep ' t lttng_channel_enable\s\[lttng_tracer\]$' /proc/kallsyms | cut -f 1 -d ' ')
- channel_disable_addr=$(grep ' t lttng_channel_disable\s\[lttng_tracer\]$' /proc/kallsyms | cut -f 1 -d ' ')
+test_success "--log-level range any" \
+ --condition event-rule-matches --domain=user --log-level=.. \
+ --action notify
- # We need to find a valid offset.
- base_symbol=""
- offset=0
- if [[ 0x$channel_enable_addr -lt 0x$channel_disable_addr ]]; then
- base_symbol="lttng_channel_enable"
- offset=$(( 0x$channel_disable_addr - 0x$channel_enable_addr ))
- else
- base_symbol="lttng_channel_disable"
- offset=$(( 0x$channel_enable_addr - 0x$channel_disable_addr ))
- fi
+test_success "--exclude-name one" \
+ --condition event-rule-matches --domain=user --name='bernard*' --exclude-name=bernard-lermite \
+ --action notify
- offset_hex="0x$(printf '%x' $offset)"
+test_success "--exclude-name two" \
+ --condition event-rule-matches --domain=user --name='jean-*' --exclude-name jean-chretien -x jean-charest \
+ --action notify
- test_success "--condition on-event probe by symbol with offset" \
- --condition on-event -k --probe="${base_symbol}+${offset_hex}" my_$base_symbol \
- --action notify
+skip $ist_root "non-root user: skipping kprobe tests" 18 || {
+ for type in kprobe kernel-probe; do
+ test_success "--condition event-rule-matches probe by symbol" \
+ --condition event-rule-matches --domain=kernel --type=$type --location=lttng_channel_enable --event-name=my_channel_enable \
+ --action notify
+
+ channel_enable_addr=$(grep ' t lttng_channel_enable\s\[lttng_tracer\]$' /proc/kallsyms | cut -f 1 -d ' ')
+ channel_disable_addr=$(grep ' t lttng_channel_disable\s\[lttng_tracer\]$' /proc/kallsyms | cut -f 1 -d ' ')
+
+ # We need to find a valid offset.
+ base_symbol=""
+ offset=0
+ if [[ 0x$channel_enable_addr -lt 0x$channel_disable_addr ]]; then
+ base_symbol="lttng_channel_enable"
+ offset=$(( 0x$channel_disable_addr - 0x$channel_enable_addr ))
+ else
+ base_symbol="lttng_channel_disable"
+ offset=$(( 0x$channel_enable_addr - 0x$channel_disable_addr ))
+ fi
+
+ offset_hex="0x$(printf '%x' $offset)"
+
+ test_success "--condition event-rule-matches probe by symbol with offset" \
+ --condition event-rule-matches --domain=kernel --type=$type --location="${base_symbol}+${offset_hex}" --event-name=my_$base_symbol \
+ --action notify
+
+ test_success "--condition event-rule-matches probe by address" \
+ --condition event-rule-matches --domain=kernel --type=$type --location="0x${channel_enable_addr}" --event-name=my_channel_enable \
+ --action notify
+ done
+}
- test_success "--condition on-event probe by address" \
- --condition on-event -k "--probe=0x${channel_enable_addr}" my_channel_enable \
- --action notify
+skip $ist_root "non-root user: skipping uprobe tests" 12 || {
+ for type in uprobe userspace-probe; do
+ test_success "--condition event-rule-matches uprobe" \
+ --condition event-rule-matches --domain=kernel --type=$type --location=${uprobe_elf_binary}:test_function --event-name=ma-probe \
+ --action notify
+
+ test_success "--condition event-rule-matches uprobe with elf prefix" \
+ --condition event-rule-matches --domain=kernel --type=$type --location=elf:${uprobe_elf_binary}:test_function --event-name=ma-probe-2 \
+ --action notify
+ done
}
-skip $ist_root "non-root user: skipping uprobe tests" 6 || {
- test_success "--condition on-event uprobe" \
- --condition on-event -k --userspace-probe=${uprobe_elf_binary}:test_function ma-probe \
+skip $ist_root "non-root user: skipping syscall tests" 30 || {
+ test_success "--condition event-rule-matches one syscall" \
+ --condition event-rule-matches --domain=kernel --type=syscall --name=open \
--action notify
- test_success "--condition on-event uprobe with elf prefix" \
- --condition on-event -k --userspace-probe=elf:${uprobe_elf_binary}:test_function ma-probe-2 \
+ test_success "--condition event-rule-matches all syscalls" \
+ --condition event-rule-matches --domain=kernel --type=syscall \
--action notify
-}
-skip $ist_root "non-root user: skipping syscall tests" 9 || {
- test_success "--condition on-event syscall" \
- --condition on-event -k --syscall open \
+ test_success "--condition event-rule-matches one syscall with filter" \
+ --condition event-rule-matches --domain=kernel --type=syscall --filter 'a > 2' --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one syscall:entry" \
+ --condition event-rule-matches --domain=kernel --type=syscall:entry --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one syscall:exit" \
+ --condition event-rule-matches --domain=kernel --type=syscall:exit --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one syscall:entry-exit" \
+ --condition event-rule-matches --domain=kernel --type=syscall:entry+exit --name=open \
--action notify
- test_success "--condition on-event syscall -a" \
- --condition on-event -k --syscall -a \
+ # Same thing but with "kernel:syscall" type instead:
+ test_success "--condition event-rule-matches one syscall" \
+ --condition event-rule-matches --domain=kernel --type=kernel:syscall --name=open \
--action notify
- test_success "--condition on-event syscall with filter" \
- --condition on-event -k --syscall --filter 'a > 2' open \
+ test_success "--condition event-rule-matches one kernel:syscall:entry" \
+ --condition event-rule-matches --domain=kernel --type=kernel:syscall:entry --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one kernel:syscall:exit" \
+ --condition event-rule-matches --domain=kernel --type=kernel:syscall:exit --name=open \
+ --action notify
+ test_success "--condition event-rule-matches one kernel:syscall:entry-exit" \
+ --condition event-rule-matches --domain=kernel --type=kernel:syscall:entry+exit --name=open \
--action notify
+
}
# `--action notify` successes
test_success "--action notify" \
- --condition on-event some-event-notify -u \
+ --condition event-rule-matches --domain=user \
--action notify
+test_success "--action notify --capture foo" \
+ --condition event-rule-matches --domain=user \
+ --capture foo --action notify
+
+test_success "--action notify --capture foo[2]" \
+ --condition event-rule-matches --domain=user \
+ --capture 'foo[2]' --action notify
+
+test_success '--action notify --capture $ctx.foo' \
+ --condition event-rule-matches --domain=user \
+ --capture '$ctx.foo' --action notify
+
+test_success '--action notify --capture $ctx.foo[2]' \
+ --condition event-rule-matches --domain=user \
+ --capture '$ctx.foo[2]' --action notify
+
+test_success '--action notify --capture $app.prov:type' \
+ --condition event-rule-matches --domain=user \
+ --capture '$app.prov:type' --action notify
+
+test_success '--action notify --capture $app.prov:type[2]' \
+ --condition event-rule-matches --domain=user \
+ --capture '$app.prov:type[2]' --action notify
+
+test_success '--action notify multiple captures' \
+ --condition event-rule-matches --domain=user \
+ --capture foo --capture '$app.hello:world' --action notify
+
# `--action start-session` successes
test_success "--action start-session" \
- --condition on-event some-event-start-session -u \
+ --condition event-rule-matches --domain=user \
--action start-session ze-session
# `--action stop-session` successes
test_success "--action stop-session foo" \
- --condition on-event some-event-stop-session -u \
+ --condition event-rule-matches --domain=user \
--action stop-session ze-session
# `--action rotate-session` successes
test_success "--action rotate-session foo" \
- --condition on-event some-event-rotate-session -u \
+ --condition event-rule-matches --domain=user \
--action rotate-session ze-session
# `--action snapshot-session` successes
test_success "--action snapshot-session foo" \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session
test_success "--action snapshot-session with file URI" \
- --condition on-event some-event-snapshot-session2 -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --path /hello
test_success "--action snapshot-session with net URI" \
- --condition on-event some-event-snapshot-session3 -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --url net://1.2.3.4
test_success "--action snapshot-session with ctrl/data URIs" \
- --condition on-event some-event-snapshot-session4 -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --ctrl-url=tcp://1.2.3.4:1234 --data-url=tcp://1.2.3.4:1235
# top-level failures
test_failure "missing --action" \
"Error: Need at least one --action." \
- --condition on-event hello -u
+ --condition event-rule-matches --domain=user
test_failure "two --condition" \
"Error: A --condition was already given." \
- --condition on-event aaa -u \
- --condition on-event bbb -u \
+ --condition event-rule-matches --name=aaa --domain=user \
+ --condition event-rule-matches --name=bbb --domain=user \
--action notify
-test_failure "missing argument to --id" \
- "Error: While parsing argument #1 (\`--id\`): Missing required argument for option \`--id\`" \
- --id
+test_failure "missing argument to --name" \
+ "Error: While parsing argument #1 (\`--name\`): Missing required argument for option \`--name\`" \
+ --name
-for cmd in fire-once-after fire-every; do
+for cmd in rate-policy=once-after rate-policy=every; do
test_failure "missing argument to --${cmd}" \
- "Error: While parsing argument #1 (\`--${cmd}\`): Missing required argument for option \`--${cmd}\`" \
- --condition on-event -u -a --action notify \
+ "Error: Rate policy format is invalid." \
+ --condition event-rule-matches --domain=user --action notify \
--${cmd}
test_failure "invalid argument to --${cmd}: non-digit character" \
- "Error: Failed to parse \`123bob\` as an integer." \
- --condition on-event -u -a --action notify \
- --${cmd} 123bob
+ "Error: Failed to parse rate policy value \`123bob\` as an integer." \
+ --condition event-rule-matches --domain=user --action notify \
+ --${cmd}:123bob
test_failure "invalid argument to --${cmd}: empty string" \
- "Error: Failed to parse \`\` as an integer." \
- --condition on-event -u -a --action notify \
- --${cmd} ""
+ "Error: Failed to parse rate policy value \`\` as an integer." \
+ --condition event-rule-matches --domain=user --action notify \
+ --${cmd}":"
done
+test_failure "invalid argument to --rate-policy: unknown policy type" \
+ "Error: Rate policy type \`bob\` unknown." \
+ --condition event-rule-matches --domain=user --action notify \
+ --rate-policy=bob:123
+
# `--condition` failures
test_failure "missing args after --condition" \
- "Error: Missing condition name." \
+ "Error: While parsing argument #1 (\`--condition\`): Missing required argument for option \`--condition\`" \
--condition
test_failure "unknown --condition" \
"Error: Unknown condition name 'zoofest'" \
--condition zoofest
-# `--condition on-event` failures
-test_failure "missing args after --condition on-event" \
- "Error: Need to provide either a tracepoint name or -a/--all." \
- --condition on-event
-test_failure "missing domain in --condition on-event" \
- "Error: Please specify a domain (--kernel/--userspace/--jul/--log4j/--python)." \
- --condition on-event -a
-test_failure "extra args after --condition on-event" \
+# `--condition event-rule-matches` failures
+test_failure "missing args after --condition event-rule-matches" \
+ "Error: Please specify a domain (--domain=(kernel,user,jul,log4j,python))." \
+ --condition event-rule-matches
+
+test_failure "extra args after --condition event-rule-matches" \
"Error: Unexpected argument 'bozo'" \
- --condition on-event foo -u bozo
-test_failure "--condition on-event: --all with --probe" \
- "Error: Can't use -a/--all with probe event rules." \
- --condition on-event --probe=do_sys_open --all
-test_failure "--condition on-event: missing tracepoint name with --probe" \
- "Error: Need to provide either a tracepoint name or -a/--all." \
- --condition on-event -k --probe do_sys_open
-
-test_failure "--condition on-event: missing tracepoint name with --userspace-probe" \
- "Error: Need to provide either a tracepoint name or -a/--all." \
- --condition on-event -k --userspace-probe=${uprobe_elf_binary}:test_function
-
-test_failure "--condition on-event: extra argument with --userspace-probe" \
- "Error: Unexpected argument 'world'" \
- --condition on-event -k --userspace-probe=${uprobe_elf_binary}:test_failure hello world
-
-test_failure "--condition on-event: missing tracepoint name with --syscall" \
- "Error: Need to provide either a tracepoint name or -a/--all." \
- --condition on-event -k --syscall
-
-test_failure "--condition on-event: extra argument with --syscall" \
+ --condition event-rule-matches --domain=user bozo
+
+test_failure "--log-level unknown level" \
+ "Error: Failed to parse log level string \`FOO\`." \
+ --condition event-rule-matches --domain=user --log-level=FOO
+
+test_failure "two same --domain" \
+ "Error: More than one \`--domain\` was specified." \
+ --condition event-rule-matches --domain=user --domain=user
+
+test_failure "two different --domain" \
+ "Error: More than one \`--domain\` was specified." \
+ --condition event-rule-matches --domain=user --domain=kernel
+
+for type in kprobe kernel-probe; do
+ test_failure "--condition event-rule-matches: --name with --type=$type" \
+ "Error: Can't use --name with probe event rules." \
+ --condition event-rule-matches --type=$type --location=do_sys_open --name='hello'
+done
+
+test_failure "--condition event-rule-matches: --location with tracepoint event rule" \
+ "Error: Can't use --location with tracepoint event rules." \
+ --condition event-rule-matches --domain=user --location='hello'
+
+test_failure "--condition event-rule-matches: --event-name with tracepoint event rule" \
+ "Error: Can't use --event-name with tracepoint event rules." \
+ --condition event-rule-matches --domain=user --event-name='hello'
+
+for type in uprobe userspace-probe; do
+ test_failure "--condition event-rule-matches: extra argument with --type=$type" \
+ "Error: Unexpected argument 'hello'" \
+ --condition event-rule-matches --domain=kernel --type=$type --location=${uprobe_elf_binary}:test_failure hello
+done
+
+test_failure "--condition event-rule-matches: extra argument with --type=syscall" \
"Error: Unexpected argument 'open'" \
- --condition on-event -k --syscall open open
+ --condition event-rule-matches --domain=kernel --type=syscall open
+
+test_failure "--condition event-rule-matches: --type=syscall:nope" \
+ "Error: Failed to parse syscall type 'syscall:nope'." \
+ --condition event-rule-matches --domain=kernel --type=syscall:nope \
+ --name=open
+
+test_failure "--exclude-name with non-glob name" \
+ "Error: Event jean: Exclusions can only be used with a globbing pattern" \
+ --condition event-rule-matches --domain=user --name='jean' --exclude-name jean-chretien \
+ --action notify
+
+test_failure "--condition event-rule-matches --capture: missing argument (end of arg list)" \
+ 'Error: While parsing argument #2 (`--capture`): Missing required argument for option `--capture`' \
+ --action notify \
+ --condition event-rule-matches --domain=user --capture
+
+test_failure "--condition event-rule-matches --capture: missing argument (before another option)" \
+ 'Error: While parsing expression `--action`: Unary operators are not allowed in capture expressions.' \
+ --condition event-rule-matches --domain=user --capture \
+ --action notify \
-test_failure "--condition on-event: both -a and a tracepoint name with --syscall" \
- "Error: Can't provide a tracepoint name with -a/--all." \
- --condition on-event -k --syscall -a open
+test_failure "--condition event-rule-matches --capture: binary operator" \
+ 'Error: While parsing expression `foo == 2`: Binary operators are not allowed in capture expressions.' \
+ --condition event-rule-matches --domain=user \
+ --capture 'foo == 2' --action notify
+
+test_failure "--condition event-rule-matches --capture: unary operator" \
+ 'Error: While parsing expression `!foo`: Unary operators are not allowed in capture expressions.' \
+ --condition event-rule-matches --domain=user \
+ --capture '!foo' --action notify
+
+test_failure "--condition event-rule-matches --capture: logical operator" \
+ 'Error: While parsing expression `foo || bar`: Logical operators are not allowed in capture expressions.' \
+ --condition event-rule-matches --domain=user \
+ --capture 'foo || bar' --action notify
+
+test_failure "--condition event-rule-matches --capture: accessing a sub-field" \
+ 'Error: While parsing expression `foo.bar`: Capturing subfields is not supported.' \
+ --condition event-rule-matches --domain=user \
+ --capture 'foo.bar' --action notify
+
+test_failure "--condition event-rule-matches --capture: accessing the sub-field of an array element" \
+ 'Error: While parsing expression `foo[3].bar`: Capturing subfields is not supported.' \
+ --condition event-rule-matches --domain=user \
+ --capture 'foo[3].bar' --action notify
+
+test_failure "--condition event-rule-matches --capture: missing colon in app-specific context field" \
+ 'Error: Invalid app-specific context field name: missing colon in `foo`.' \
+ --condition event-rule-matches --domain=user \
+ --capture '$app.foo' --action notify
+
+test_failure "--condition event-rule-matches --capture: missing colon in app-specific context field" \
+ 'Error: Invalid app-specific context field name: missing type name after colon in `foo:`.' \
+ --condition event-rule-matches --domain=user \
+ --capture '$app.foo:' --action notify
# `--action` failures
test_failure "missing args after --action" \
- "Error: Missing action name." \
- --condition on-event -u -a \
+ "Error: While parsing argument #1 (\`--action\`): Missing required argument for option \`--action\`" \
+ --condition event-rule-matches --domain=user \
--action
# `--action notify` failures
test_failure "extra arg after --action notify" \
"Error: Unexpected argument \`bob\`." \
- --condition on-event -u -a \
+ --condition event-rule-matches --domain=user \
--action notify bob
# `--action start-session` failures
test_failure "missing arg after --action start-session" \
"Error: Missing session name." \
- --condition on-event some-event-start-session -u \
+ --condition event-rule-matches --domain=user \
--action start-session
test_failure "extra arg after --action start-session" \
"Error: Unexpected argument \`bob\`." \
- --condition on-event some-event-start-session -u \
+ --condition event-rule-matches --domain=user \
--action start-session ze-session bob
# `--action stop-session` failures
test_failure "missing arg after --action stop-session" \
"Error: Missing session name." \
- --condition on-event some-event-stop-session -u \
+ --condition event-rule-matches --domain=user \
--action stop-session
test_failure "extra arg after --action stop-session" \
"Error: Unexpected argument \`bob\`." \
- --condition on-event some-event-stop-session -u \
+ --condition event-rule-matches --domain=user \
--action stop-session ze-session bob
# `--action rotate-session` failures
test_failure "missing arg after --action rotate-session" \
"Error: Missing session name." \
- --condition on-event some-event-rotate-session -u \
+ --condition event-rule-matches --domain=user \
--action rotate-session
test_failure "extra arg after --action rotate-session" \
"Error: Unexpected argument \`bob\`." \
- --condition on-event some-event-rotate-session -u \
+ --condition event-rule-matches --domain=user \
--action rotate-session ze-session bob
# `--action snapshot-session` failures
test_failure "missing arg after --action snapshot-session" \
"Error: Missing session name." \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session
test_failure "extra arg after --action snapshot-session" \
"Error: Unexpected argument \`bob\`." \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session bob
test_failure "snapshot-session action, --max-size without destination" \
"Error: Can't provide a snapshot output max size without a snapshot output destination." \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --max-size 10M
test_failure "snapshot-session action, --name without destination" \
"Error: Can't provide a snapshot output name without a snapshot output destination." \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --name hallo
test_failure "snapshot-session action, --name with-local-path-instead-of-url" \
"Error: Failed to parse '/something/that/looks/like/a/path' as an URL." \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --name hallo --url /something/that/looks/like/a/path
test_failure "snapshot-session action, --name with-net-url-instead-of-path" \
"Error: Failed to parse 'net://8.8.8.8/' as a local path." \
- --condition on-event some-event-snapshot-session -u \
+ --condition event-rule-matches --domain=user \
--action snapshot-session ze-session --name hallo --path net://8.8.8.8/
# Cleanup