How to get an alert : when an Irule got Changed/Modified ?

This solution article shows you how to send email triggered by a log message.

http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=35995690

To customize the examples in the link above to alert on iRule changes you can use this alert config in /config/user_alert.conf

alert IRULE_CHANGE_NOTIFICATION "*//*" {
        email toaddress="demo@askf5.com"
        fromaddress="root"
        body="The iRule // was modified !"
}

Replace and with real values.

The system sends this message to /var/log/ltm when an iRule is saved which will cause alertd to send you the email:

err mcpd[6534]: 01020066:3: The requested iRule (/Common/test) already exists in partition Common.

The log messages that Mohammed shows above are actually more reliable than this but, they would require changing more system files in order to force alertd to look into the /var/log/audit instead of /var/log/ltm.

HTH.