Collecting website statistics

I'm not sure whether you're hitting a resource limit on the BIG-IP trying to log ~175 events/sec or if the rule could be streamlined to improve the situation.

Do you need to calculate the time using clock? The log entries should already have a timestamp. I realize this would require more post-processing but I'm guessing you would already need to take out the default timestamp with the rule you're testing now.

You could also remove the intermediate variables referer and useragent. and just use log_format to save the values for reference in HTTP_RESPONSE.

Are you seeing [HTTP::payload length] return a value in HTTP_RESPONSE? I would think this would always be 0 unless you were collecting the response data and logging the value in HTTP_RESPONSE_DATA. If you want to get the response size, you could try logging HTTP::header value Content-Length. Of course, this won't be valid for chunked responses.

when HTTP_REQUEST {
   set log_format "[IP::client_addr] - - - \"[HTTP::method] [HTTP::uri] \
      HTTP/[HTTP::version]\" \"[HTTP::header value Referer]\" \"[HTTP::header value User-Agent]\""
}
when HTTP_RESPONSE {
   log local1.info "$log_format [HTTP::status] [HTTP::header value Content-Length]"
}

[Edit: also, what version of BIG-IP are you running? I think there was an issue with the clock command in early 9.x versions]

Aaron