HSL Logging - Filtering it so that you only get the connection information

You're facing two challenges:

1. Each user may open several connections.
2. A user may make multiple requests on the same connection.

You have a number of options to cut down on the log traffic:

1. Log only connections (CLIENT_ACCEPTED). This would of course not log the requests. However, you could set a flag (semaphore) that you can then use it to log the first request in HTTP_REQUEST.
2. Limit logging to requests without an extension and known pages.