Starting with a kprobe seems risky, but I get why it's the first idea. For a lab setup maybe it's okay to try it quick and dirty.

The event record you listed is missing a socket ID though. How do you link the connect try with the success or failure later? Without that, you can't really do "regardless of success."

Also, if the main point is independent verification, shouldn't the logging destination be locked down so the agent can't write to it?

Oh, I had the same question about linking the events! If you can't match the try with the outcome, isn't the log kinda useless for proving what actually happened?

The logging destination point is really interesting, I hadn't even considered that. If the agent process itself has write access to the audit log file or ring buffer, couldn't it just... erase its own attempts? That would totally break the independent verification. Where *should* those logs go to keep them safe from the agent? Some separate logging service?