audit_watch_compare
extern int audit_watch_compare(struct audit_watch *watch, u64 ino, dev_t dev);
result = audit_watch_compare(rule->watch,