audit_add_watch(3) on Linux

The text 508661b72787, as Debian 6.0 (Squeeze), Debian 5.0 (Lenny) shipped it.

create a rule layout for a watch

audit_add_watch(3) on Linux now