URL Logging, Hitcount, IP addresses

I'd suggest you are very careful using this to log the IP addresses as you may find your log files grows very quickly and the HSM may run out of disk space - use with care. This rule requires a Statistics Profile call busyurls and counters called 123, xyz and abc.

when HTTP_REQUEST {
 switch -glob [string tolower [HTTP::uri]] {
   "/test?123*" {
    log local0. "[IP::client_addr] connected to [HTTP::host][HTTP::uri]"
    STATS::incr busyurls 123
   }
   "/test?xyz*" {
    log local0. "[IP::client_addr] connected to [HTTP::host][HTTP::uri]"
    STATS::incr busyurls xyz
   }
   "/test?abc*" {
    log local0. "[IP::client_addr] connected to [HTTP::host][HTTP::uri]"
    STATS::incr busyurls abc
    }
 }
}