audit_rule_change
extern int audit_rule_change(int type, int seq, void *data, size_t datasz);
err = audit_rule_change(msg_type, seq, data, data_len);