diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 748199b4..cbe4cdf1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -306,6 +306,22 @@ jobs:
                 bash /host/testdata/test_docker_filter_by_pid.sh '/host/kyanos/kyanos $kyanos_log_option'
             fi
 
+      - name: Test filter by comm
+        uses: cilium/little-vm-helper@97c89f004bd0ab4caeacfe92ebc956e13e362e6b # v0.0.19
+        with:
+          provision: 'false'
+          cmd: |
+            set -ex
+            uname -a
+            cat /etc/issue
+            pushd /host
+            if [ -f "/var/lib/kyanos/btf/current.btf" ]; then
+                bash /host/testdata/test_filter_by_comm.sh '/host/kyanos/kyanos $kyanos_log_option --btf /var/lib/kyanos/btf/current.btf'
+            else
+                bash /host/testdata/test_filter_by_comm.sh '/host/kyanos/kyanos $kyanos_log_option'
+            fi
+            popd
+
       - name: Test test containerd filter by container name
         uses: cilium/little-vm-helper@97c89f004bd0ab4caeacfe92ebc956e13e362e6b # v0.0.19
         with:
diff --git a/testdata/test_filter_by_comm.sh b/testdata/test_filter_by_comm.sh
new file mode 100644
index 00000000..c80c9d59
--- /dev/null
+++ b/testdata/test_filter_by_comm.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+. $(dirname "$0")/common.sh
+set -ex
+
+CMD="$1"
+FILE_PREFIX="/tmp/kyanos"
+BEFORE_LNAME="${FILE_PREFIX}_filter_by_comm_before.log"
+AFTER_LNAME="${FILE_PREFIX}_filter_by_comm_after.log"
+
+function test_filter_by_comm() {
+    openssl req -x509 -newkey rsa:2048 -keyout server.pem -out server.pem -days 365 -nodes -subj "/C=US/ST=California/L=San Francisco/O=My Company/CN=localhost"
+
+    pip install --break-system-packages ssl || true
+
+    # server start before kyanos
+    timeout 40 python3 ./testdata/start_https_server.py  &
+    timeout 30 ${CMD} watch --debug-output http --comm python3 2>&1 | tee "${BEFORE_LNAME}" &
+    curl --insecure https://127.0.0.1:4443 &>/dev/null || true
+    sleep 5
+    wait
+
+    cat "${BEFORE_LNAME}"
+    cat "${BEFORE_LNAME}" | grep "127.0.0.1:4443"
+
+    # server start after kyanos
+    timeout 40 ${CMD} watch --debug-output http --comm python3 2>&1 | tee "${AFTER_LNAME}" &
+    timeout 30 python3 ./testdata/start_https_server.py  &
+    curl --insecure https://127.0.0.1:4443 &>/dev/null || true
+    sleep 5
+    wait
+
+    cat "${AFTER_LNAME}"
+    cat "${AFTER_LNAME}" | grep "127.0.0.1:4443"
+}
+
+function main() {
+    test_filter_by_comm
+}
+
+main
\ No newline at end of file