id: `select * from process_events where cmdline !=...
# general
c
id:
select * from process_events where cmdline !='process_name';