Require User ID of client connected in logs.

check out - https://devcentral.f5.com/wiki/iRules.CLIENTSSL_CLIENTCERT.ashx

the second example in that wiki page (included below) should be a good starting point. i would log that value remotely using HSL instead of logging locally

when CLIENTSSL_CLIENTCERT {

    Debug flag
   set debug 1

    Check if client presented a cert after it was requested/required
   if {[SSL::cert count] > 0}{

       Client presented at least one cert.  The actual client cert should always be first.
      if {$debug > 1}{

      Loop through each cert and log the cert subject, issuer and serial number
         for {set i 0} {$i < [SSL::cert count]} {incr i}{

            log local0. "[IP::client_addr]:[TCP::client_port]: cert $i; subject=[X509::subject [SSL::cert $i]];\
               [X509::issuer [SSL::cert $i]]; cert_serial=[X509::serial_number [SSL::cert $i]];"
         }
      }
   } else {
      if {$debug > 1}{log local0. "[IP::client_addr]:[TCP::client_port]: No client cert found!"}
   }
}