> There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures.

I'm wondering if this would be a use case for eBPF