iRule help for server response time

You are very close! A few things:

1. conditionals in Tcl are implicitly wrapped in an expr, so there is no need to rewrap the expression;
2. there is no then sub-command/keyword;
3. all code must be in an event block;
4. IP::local_addr and TCP::local_port have two contexts: the clientside (which means the Virtual Server VIP:port) and the serverside (which means the source address and port for the proxy connection toward the Pool Member). If you are not explicit about which context you mean, the context appropriate for the event will be used. Thus, for HTTP_RESPONSE, the implicit context is serverside, so to mean "VIP:port", you must explicitly disambiguate using the clientside command;
5. HTTP::uri is not available in HTTP_RESPONSE so you must retrieve and store the value in HTTP_REQUEST.

A few references regarding this:

• https://devcentral.f5.com/wiki/iRules.clientside.ashx
• See Valid Events section of https://devcentral.f5.com/wiki/iRules.HTTP__uri.ashx

when HTTP_REQUEST {
    set http_request_time [clock clicks -milliseconds]
    set request_uri [HTTP::uri]
}

when HTTP_RESPONSE {
    if { [clock clicks -milliseconds] - $http_request_time > 1000 } { 
        log local0. "Server response took longer than 1000ms. TCP connection from [IP::client_addr]:[TCP::client_port] to [clientside [IP::local_addr]]:[clientside [TCP::local_port]]. Requested URI is $request_uri"
    }
}

For production usage, you should consider either using High-Speed Logging or, better yet, the built-in HTTP Request Logging Profile employing CLIENT_IP, CLIENT_PORT, VIRTUAL_IP, VIRTUAL_PORT, HTTP_URI and RESPONSE_MSECS in the template. This would log every request, but you could process the (remotely deposited) logs for those that take longer than a threshold (like 1000 ms).