Show command line for a given command execed by any proc: sysdig -p"%proc.exeline" evt.buffer contains <command>