looking for Irule that will log unique source ip one time

Unique over what sort of period? Unique ever? Last 5 minutes? Since the TMM was restarted?

The iRule itself is easy. It's where the lookup is performed to verify whether the IP is unique or not is the harder (And possibly very performance impacting) problem.

If you need to make it external, I'd do a combination of a local table of fixed size, and send a log message externally every time it adds a new IP to the table. Then if you want longer-term unique, use a separate external DN and program to further filter that list down.

Sorry, lack of time prohibits me writing the iRule for you... But look at the CLIENT_ACCEPT event, tables (For holding the previously seen IP's) and HSL (High Speed Logging).

H