audit_add_watch   298 kernel/audit.h #define audit_add_watch(k, l) (-EINVAL)
audit_add_watch   401 kernel/audit_watch.c int audit_add_watch(struct audit_krule *krule, struct list_head **list)