irule to identify SIP 603 message

Hello, I apologize for this late reply. I'm responding anyway in case you're still having issues.

First of all, which version of TMOS are you running?

Are you getting any errors? I would expect the SIP::response method to return nothing for the two REQUEST events. Valid events would be SIP_RESPONSE, SIP_RESPONSE_SEND, MR_INGRESS and MR_EGRESS (the last two are generalized for all of the Message Routing protocols).

Do you see your log messages show up at all? If not, your iRule is probably not firing. Double check that your virtual server has the correct rule(s) attached. Then, verify that traffic is passing by capturing packets (tcpdump or similar). And of course, verify that you are looking ar the correct log file.

If you do see some log output, please paste a sample of the logs after passing traffic.

Try the following:

when SIP_RESPONSE { 
    log local0. "SIP response: code = [SIP::response code] phrase = [SIP::response phrase]"
    if {[SIP::response code] == "603"} {
        log local0. "DECLINE"
    }
}

To answer on your question about which events to use, think of it this way. What type of message would contain a response code? A request message? No. A response message. If you're only interested in incoming (received) response messages, go with SIP_RESPONSE or MR_INGRESS. The two "_SEND" events are for outgoing message (from BIGIP to server).

You can read about these events here.