NimbostratusHi Andreas,
Thank you for this iRule, it gave us a good start.
I have a few additions to your iRule:
1) You are overwriting $version on the response so I think it should be (as an example):
in the request section set version_req [HTTP::version]
in the response section set version_res [HTTP::version]
then in syslog you need a custom rule to log them individually unless you don't really care then you should only log the version from the user since this is by default (in your case you have the version from the server on the response).
2) We started encoding all user input because we hit an issue when you can send "\n" (new line) in a different encoding so the HSL function will send two lines which means syslog will "drop" the rest of the request (you will never see the full request).
Best, Rafal.