Logging client IP address for SSH attempts

You can do as below

when CLIENT_ACCEPTED { log 192.168.xx.xx local0.info "Request for service at port [TCP::local_port] from [IP::client_addr]" }

The logs will be in text format. The file location will be defined in /etc/syslog.conf(assuming *nix system) in the remote syslog server

On the remote syslog server, you have to enable remote syslog for the syslog clients, in this case bigip IP address.

http://www.freebsd.org/doc/handbook/network-syslogd.html

You can test it using 'logger' cmd from bigip, before testing with iRule.

logger -h 192.168.xx.xx -p local0.info "Testing"