Searching for system call rule violations