rule_eval
halt = rule_eval(rbegin, &bt_devt);
if (rule_eval(r, dtev))
rule_eval(rend, &bt_devt);
int rule_eval(struct bt_rule *, struct dt_evt *);