Q:

how to use audit in linux to monitor a file using libaudit

A previous question showed code for libaudit
How to use libaudit?
but the answer is not a complete example. I added include files to create a mwe, and it doesn't work. In this case, I am monitoring a file, and expected that the monitoring function would be called back whenever the file is changed. I tried touch, and appending to the file, and nothing happens. Can anyone spot what I am doing wrong?
#include <stdio.h>
#include <libaudit.h>
#include <unistd.h>
#include <ev.h>

int fd;

void monitoring(struct ev_loop *loop, struct ev_io *io, int revents) {
    struct audit_reply reply;

    audit_get_reply(fd, &reply, GET_REPLY_NONBLOCKING, 0);

    if (reply.type != AUDIT_EOE &&
            reply.type != AUDIT_PROCTITLE &&
            reply.type != AUDIT_PATH) {
        printf("Event: Type=%s Message=%.*s\n",
                     audit_msg_type_to_name(reply.type),
                     reply.len,
                     reply.message);
    }
}

int main() {
    fd = audit_open();
    struct audit_rule_data* rule = new audit_rule_data();

    // what directory we will follow.
    //  audit_add_watch_dir(AUDIT_DIR, &rule, "foo");

    audit_add_watch(&rule, "foo/test.txt");

    // setting rule.
    audit_add_rule_data(fd, rule, AUDIT_FILTER_USER, AUDIT_ALWAYS);
    struct ev_io monitor;
    audit_set_pid(fd, getpid(), WAIT_YES);

    audit_set_enabled(fd, 1);
    struct ev_loop *loop = ev_default_loop(EVFLAG_NOENV);

    ev_io_init(&monitor, monitoring, fd, EV_READ);
    ev_io_start(loop, &monitor);

    ev_loop(loop, 0);

    audit_close(fd);
    return 0;
}

A:

It turns out I forgot to run with sudo, this can only be run with root permission but it did not crash, just nothing was reported.

