How to work with the libaudit library?

Question

linux

I'm trying to figure out how to work with the libaudit library, I want to write a C / C ++ service that will receive events about user actions (what files I opened, what I launched, what I tried to change, whether I tried to transfer something over a network connection).
For example, for the test, I set a rule to track the creation of a directory in / tmp:

int audit_fd = audit_open();

struct audit_rule_data *rule = (struct audit_rule_data *) malloc(sizeof(struct audit_rule_data));
memset(rule, 0, sizeof(struct audit_rule_data));

audit_rule_syscallbyname_data(rule, "mkdir");
audit_add_watch_dir(AUDIT_DIR, &rule, "/tmp");
audit_add_rule_data(audit_fd,
                        rule,
                        AUDIT_FILTER_USER,
                        AUDIT_ALWAYS);

int rc;
fd_set read_mask;
FD_ZERO(&read_mask);
FD_SET(audit_fd, &read_mask);

struct timeval t;
t.tv_sec  = 0;
t.tv_usec = 300 * 1000;

do
{
    rc = select(audit_fd+1, &read_mask, NULL, NULL, &t /*NULL*/);

    struct audit_reply rep;
    audit_get_reply(audit_fd, &rep, GET_REPLY_NONBLOCKING, 0);

    if (rep != NULL)
    {
        printf("%s", rep.message);
        break;
    }
}
while (rc < 0); 

audit_close(audit_fd);

But setting the audit rule does not work, has anyone worked with this library? What's wrong? Or maybe there are other ways to receive events about user actions?