audit_log_rule_change
audit_log_rule_change("add_rule", &entry->rule, !err);
audit_log_rule_change("remove_rule", &entry->rule, !err);