irule determine if request is ssl

within the iRule look for the CLIENTSSL_CLIENTHELLO triggering.

https://devcentral.f5.com/wiki/irules.CLIENTSSL_CLIENTHELLO.ashx

Assuming you had a VIP that was listening on multiple ports, probably the easiest thing would be to simply evaluate the port in a layer 4 event. Example:

when CLIENT_ACCEPTED {
    if { [TCP::local_port] equals "443" } {
         this is most likely an SSL request
    }
}

use CLIENTSSL_CLIENTHELLO for loging SSL requests.

Also, keep in mind that an iRule without SSL offloading has limited capabilities.