BIG-IP 13.X - Connections per Cipher String

For sure there is more than one solution for this. You could simply log to /var/log/ltm with an iRule

when HTTP_REQUEST {
    log local0. "TLS Logging - Client: [IP::client_addr] Server: [virtual name] Cipher: [SSL::cipher version]" }

And since logging locally is not a great idea.... You could also use HSL, Splunk in my example, for remote logging:

when CLIENT_ACCEPTED {
    set hsl [HSL::open -publisher /Common/splunk]
}
 
when HTTP_REQUEST {
    HSL::send $hsl "TLS Logging - Client: [IP::client_addr] Server: [virtual name] Cipher: [SSL::cipher version]"    
}