---
name: "audit_add_watch"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audit_add_watch"
---

# audit\_add\_watch(3)

create a rule layout for a watch

## NAME

audit\_add\_watch - create a rule layout for a watch

## SYNOPSIS

```
#include <libaudit.h>
```

**int audit\_add\_watch(struct audit\_rule\_data \*\****rulep***, const char \****path***);"**

## DESCRIPTION

audit\_add\_watch will create a watch rule in the pointer to a pointer *rulep*. All that you need to pass it is the full *path* to a file and it will initialize the audit\_rule\_data structure for a watch.

## RETURN VALUE

Returns -1 if an error occurs; otherwise, 0 for success.

## SEE ALSO

[**audit\_add\_rule\_data**(3)](/audit_add_rule_data/3.md), [**audit\_delete\_rule\_data**(3)](/audit_delete_rule_data/3.md).

## AUTHOR

Steve Grubb