Documents that might help others.
You came here so you could have a base code to serve you as an example on how to develop a BPF application, compatible to BCC and/or LIBBPF, specially LIBBPF, having the userland part made in C or PYTHON.
IPset audit is capable of logging IPset creation, deletion and modification to syslog. It uses eBPF to get information from IPset kernel handlers and inform a userland daemon that talks to syslog.