Detecting a bypass attempt can generally only be successfully done if you are detecting a successful bypass attempt. Assuming you are using Linux, this can be done safely by using
iptables, which is the frontend for the system's firewall. If you make Tor run as its own user (for example, by using Tor in a distro's repository), you can set
iptables to deny all network connections which are not coming from the dedicated Tor user. Violations can then be logged.
The Tails live operating system does this. All applications on Tails are configured to only go over Tor, and any applications which try to connect to the internet directly (whether due to being misconfigured, or having been compromised) will be blocked, with logs sent to the system log.