Using request Logging Profile with external syslog server: to log as HTTP Apache format

You could do this with a request logging profile and save the trouble of an iRule. The following guide talks about an ArcSight log entry looking like this:

http://mita-tac.wikispaces.com/file/view/CEF+White+Paper+071709.pdf

CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension

Ex. Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2 spt=1232

Here’s details on the request logging profile.

http://support.f5.com/kb/en-us/products/big-ip-aam/manuals/product/aam-implementations-11-4-0/20.html?sr=33764514

Based on that document, a fairly common request logging filter might look something like this:

$DATE_NCSA - $CLIENT_IP - $SERVER_IP - $HTTP_REQUEST - $HTTP_STATUS - ${User-agent}