audit_watch_log_rule_change 305 kernel/audit_watch.c audit_watch_log_rule_change(r, owatch, "updated_rules"); audit_watch_log_rule_change 333 kernel/audit_watch.c audit_watch_log_rule_change(r, w, "remove_rule");