audit_to_watch
extern int audit_to_watch(struct audit_krule *krule, char *path, int len,
err = audit_to_watch(&entry->rule, str, f_val, f->op);