audit_remove_watch_rule  260 kernel/audit.h extern void audit_remove_watch_rule(struct audit_krule *krule);
audit_remove_watch_rule 1039 kernel/auditfilter.c 		audit_remove_watch_rule(&e->rule);