Check for ActiveSync failed logins using iRules

Packet capture is indeed the right place to start. You might be able to do this really easily just by looking at whether there are two consecutive 401/403s. That'd be more efficient than having to look at the response payload.