VS total connections to SYSLOG

Yes, you can do with an iRule.

However, you could also use EM (not sure if BIGIQ is already doing this functionality). EM monitors and records multiple metrics about a BIGIP:

https://support.f5.com/kb/en-us/products/em/manuals/product/em-health-activity-monitoring-3-1-1/5.htmlunique_1362354363

https://f5.com/products/big-iq-centralized-management

You could also just run a tmsh command at a regular interval using cron. After, just save the output to syslog (with logger). Some solutions to help with that:

For cron examples:

https://support.f5.com/csp/article/K13418

For logger:

https://support.f5.com/csp/article/K11127

An iRule for that is not difficult. You need to use clock command to check the time, and based in the documentation, the FLOWTABLE::count command should provide you the virtual server metric.

For clock command:

https://www.tcl.tk/man/tcl/TclCmd/clock.htm

For FLOWTABLE::count:

https://devcentral.f5.com/wiki/iRules.FLOWTABLE__count.ashx

Concluding, if you have EM (or BIGIP), I would go there first. After, I would prefer tmsh commands with cron. iRule would be my last option, as is more resource intensive as at least you have to calculate the time every new connection. Also, don't forget you need to have traffic all the time to trigger the iRule, otherwise nothing will be logged during quiet times.