Identifying specific Header and logging time they attach?

You might try this:

  
  when HTTP_REQUEST {  
     Log the start of a new HTTP request  
     set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"  
     log local0. "$LogString (request)"  
  }  
  

I lifted this bit from a larger iRule

http://devcentral.f5.com/wiki/default.aspx/iRules/LogTcpAndHttpRequestResponseInfo.html

...that logs a ton of additional information. Log size can be concerning, especially if you have a lot of traffic. Why not log these entries off of the LTM completely, via syslog? There's some information on syslogging from within an iRule here:

http://devcentral.f5.com/wiki/default.aspx/iRules/log.html