My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address and port) is available to trace any unauthorized or malicious access. Currently we use TCP Wrappers (either the libwrap library or the tcpd executable) for this purpose.
However, Red Hat Enterprise Linux 8 no longer provides tcpd and libwrap in the standard distribution, and it appears other Linux distributions are going to follow suit. Red Hat suggests using firewalld or iptables to enforce rules restricting connections, but it seems like there isn't a good replacement for simply logging new connections, without requiring enforcement and without logging every single packet (which would be a nightmare performance-wise).
Any suggestions on a replacement for TCP Wrappers just for logging purposes?