matches_auditlog
EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "saddr",
EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "daddr",
EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.bind_udp",
EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "daddr",
EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.connect_send_udp",
EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.bind_udp", NULL,
EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.connect_send_udp",