IP_EXEC_CREATED
comparam == IP_EXEC_CREATED || comparam == IP_EXEC_START ||
[IP_EXEC_CREATED] = {"exec.created", PF_INTERNAL},
IP_EXEC_CREATED,