APM trouble shooting portal access

im wondering if there is a good way to troubleshoot portal access slowness? customer is saying they experience more slowness when going through the webtop. (a little might be expected, of course the trip to the APM takes time, but the say it is in the order of 10 seconds).

 

of course i can pull out tcpdump and start capturing, but with an on-a-stick configuration, https and lots of production traffic that is going to mean a lot of data and a lot of work to match sessions.

 

i checked the web application trace option, but that doesnt seem to log timestamps (shame btw, would be really useful).

 

writing an irule to log requests and responses might be an option, but again quite some work.

 

am i overlooking another option? or will it come down to one of the above (tcpdump / irule)?

 

anyone ever experienced f5 support troubleshooting this, what do they do?