An iRule attached to the CLIENT_ACCEPTED event will be executed for each connection.
What you may be seeing is that a refresh on a browser window will not necessarily create new connections. It will re-use existing connections to get your information. This is the default standard for HTTP 1.1.
It is easy to test this behaviour. Attach this iRule to your virtual and watch the logs /var/log/ltm as you hit refresh on your browser. You may get the desired behaviour with shift-refresh but your milage will vary depending on the browser's implementation.
when CLIENT_ACCEPTED {
set cid [clock clicks]
log local0. "\[$cid\] Found... TCP CONNECTION!"
}
when HTTP_REQUEST {
log local0. "\[$cid\] Found... HTTP REQUEST!"
}
The number in brackets [451544] at the start of each log message will be a unique number representing that TCP connection. Because the BIGIP handles many connections in parallel this helps you to determine which connection the log entry belongs to.