audit_watch_log_rule_change  305 kernel/audit_watch.c 			audit_watch_log_rule_change(r, owatch, "updated_rules");
audit_watch_log_rule_change  333 kernel/audit_watch.c 			audit_watch_log_rule_change(r, w, "remove_rule");