AUDIT\_ADD\_WATCH(3) Linux Audit API AUDIT\_ADD\_WATCH(3)

# [NAME](#NAME)

audit\_add\_watch - create a rule layout for a watch

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
int audit_add_watch(struct audit_rule_data **rulep, const char *path);"
```

# [DESCRIPTION](#DESCRIPTION)

audit\_add\_watch will create a watch rule in the pointer to a pointer *rulep*. All that you need to pass it is the full *path* to a file and it will initialize the audit\_rule\_data structure for a watch.

# [RETURN VALUE](#RETURN_VALUE)

Returns -1 if an error occurs; otherwise, 0 for success.

# [SEE ALSO](#SEE_ALSO)

[**audit\_add\_rule\_data**(3)](/man/os/audit/audit_add_rule_data.3), [**audit\_delete\_rule\_data**(3)](/man/os/audit/audit_delete_rule_data.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

Feb 2007 Red Hat

---

Document: audit_add_watch(3) from audit 4.2.1-r4 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace