SSL Cipher (reporting, graphing, logging)

We've had a requirement to do this as well, we offload SSL to the LTM device and then apply the following iRule, it logs to the LTM log which we ship off to syslog into a separate file.

when LB_SELECTED { log -noname local0. "SSL Cipher [SSL::cipher name] selected by client [IP::remote_addr] for pool [LB::server pool]" }

I have a slightly more verbose iRule for this.

when HTTP_REQUEST {

    if { [info exists logged] && $logged == 1 }{
         Do nothing. Already logged for this connection
    } else {
        set logged 1
        log "Rule CIPHER_logging fired, from [IP::remote_addr] to vip [IP::local_addr] Cipher [SSL::cipher name]:[SSL::cipher version]:[SSL::cipher bits] Client:[HTTP::header "User-Agent"]:[HTTP::host]"
    }
}

The SSL:: commands only work if you process the SSL at the F5. If you're passing SSL traffic through, you have to get a little deeper in the weeds. Here's a very crude example of what it might look like to sniff the negotiated cipher from the server's ServerHello message:

when CLIENT_ACCEPTED {
     store client IP
    set clientip [IP::client_addr]
}
when SERVER_CONNECTED {
     collecting server side responses
    TCP::collect
}
when SERVER_DATA {
     sniffing the packet type
    binary scan [TCP::payload] cSSc type len ver hs
     22 = SSL handshake, 2 = ServerHello 
    if { ( $type == 22 ) and ( $hs == 2 ) } {
        binary scan [TCP::payload] H86H2 sh sidlen
        if { $sidlen ne "00" } {
             if sidlen not 00 (session ID length), skip past ID and collect cipher
            scan $sidlen %x dec
            set dec [expr $dec * 2]
            binary scan [TCP::payload] H88H${dec}H4 sh sid cipher
            log local0. "Client: $clientip negotiated cipher: $cipher"
        } else {
             no session ID, collect cipher
            binary scan [TCP::payload] H88H4 sh cipher
            log local0. "Client: $clientip negotiated cipher: $cipher"
        }
    }
    TCP::release
}

Again, stressing very crude example. The log will show something like this:

Client: 10.70.0.51 negotiated cipher: c030

The "c030" here is the hexadecimal value of the cipher version, as defined here:

http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml

So c030 = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

All very useful answers, thanks very much for everyone's input. Just got to decide weather to move the SSL to the F5 or not now..

Thanks again

@Kevin Stewart I tried to use the rule which you mentioned. I was unable to get the content type as 22 in the payload. Not sure why. I extracted all the bytes from the payload nothing made sense to me. Here is what it logs: Type == 72 84 84 80 47 49 46 49 32 50 48 ..... 125 125

Here is the part of the rule modified:

when SERVER_DATA {