writing an irule to log all traffic

Here is an example of how you can use clock to get deltas between different points in the rule execution:

when CLIENT_ACCEPTED {
   set tcp_start_time [clock clicks -milliseconds]
}
when HTTP_REQUEST {
   set http_request_time [clock clicks -milliseconds]
}
when HTTP_RESPONSE {
   set http_response_time [ clock clicks -milliseconds ]
}
when CLIENT_CLOSED {
   set tcp_end_time [ clock clicks -milliseconds ]
   log local0. "HTTP request/response difference: $http_response_time - $http_request_time = [expr $http_response_time - $http_request_time]"
   log local0. "Total connection time: $tcp_end_time - $tcp_start_time = [expr ($tcp_end_time - $tcp_start_time)]"
}

Apparently, there was an issue with high CPU usage when using the clock command in versions prior to 9.2. I did some searching but couldn't find any relevant CR's. I would upgrade to 9.2.3+ to use the clock function and would make sure to test this rule during a maintenance window if you're applying it to every connection through the BIG-IP.

Aaron