These kind of tools are very nice for some things, but I don't use them very often. I guess I'm fortunate in that I tend to have more than 1 BIG-IP nearby so I can use another BIG-IP as the proxy to collect stats and modify traffic. :)
I have an iRule that logs essentially every major iRule parameter during the events I commonly use. It breaks out the traffic by protocol (Ethernet, IP, TCP, HTTP) so it can be somewhat vaguely readable while presenting a bunch of data. The primary use is for debugging so it outputs everything at every step -- more than just stats (the MAC addresses and IP's and ports at every stage...since they can definitely change if you're using tricky iRules!).
I've pasted a partial example of the output. This shows just the HTTP_RESPONSE event, but the same sort of stuff is printed in every event it's available
-------- START: rule_log_requests --------
client { 172.16.100.254:54622 -> 172.16.100.100:80 }
server { 172.16.200.250:54622 -> 172.16.200.1:80 }
ethernet { 00:50:56:c0:00:03 -> 00:50:56:83:0a:f4 tag 50 qos 0 }
*200 1.1 - REDIR 0, Content-Length 1456, Transfer-Encoding
*TCP MSS(1460) BW(0) RTT(2748) OFFSET(0)
*IP TOS 0, HOPS 0, TTL 64, PKTS_IN 3, PKTS_OUT 3, BYTES_IN 1654, BYTES_OUT 353
*HTTP HOST , KEEPALIVE 1, REQ_NUM 1
-------- END: rule_log_requests --------
For monitoring type stuff I tend to use time-conditional iRule log statements (i.e. "this request is taking too long") like the example in Code Share / forums. Or for counter-type stuff (like bucketizing stats) I've found the stats profile stuff to be pretty handy.
Below is an example with stats profiles that does buckets for file type (cached/not cached) and "visitors" based on a lame cookie check. The same sort of thing works for buckets of response time, size, etc.
----- START: my_stats_irule -----
profile stats my_stats_profile {
defaults from stats
field1 cfm
field2 htm
field3 asp
field4 img
field5 css
field6 js
field7 pdf
field8 swf
field9 other
field10 cache_cfm
field11 cache_htm
field12 cache_asp
field13 cache_img
field14 cache_css
field15 cache_js
field16 cache_pdf
field17 cache_swf
field18 cache_other
field19 visitors
}
rule my_stats_irule {
when HTTP_REQUEST {
switch -glob [HTTP::path] {
"*.cfm" { STATS::incr my_stats_profile cfm }
"*.html" -
"*.htm" { STATS::incr my_stats_profile htm }
"/" -
"*.aspx" -
"*.asp" { STATS::incr my_stats_profile asp }
"*.jpeg" -
"*.jpg" -
"*.gif" { STATS::incr my_stats_profile img }
"*.css" { STATS::incr my_stats_profile css }
"*.js" { STATS::incr my_stats_profile js }
"*.pdf" { STATS::incr my_stats_profile pdf }
"*.swf" { STATS::incr my_stats_profile swf }
default { STATS::incr my_stats_profile other }
}
set needs_cookie 1
if { [HTTP::cookie exists "myCNT"] } {
set needs_cookie 0
}
}
when HTTP_RESPONSE {
if { $needs_cookie == 1 } {
STATS::incr my_stats_profile visitors
HTTP::cookie insert name "myCNT" value "1"
}
}
when CACHE_REQUEST {
switch -glob [HTTP::uri] {
"*.cfm" { STATS::incr my_stats_profile cache_cfm }
"*.html" -
"*.htm" { STATS::incr my_stats_profile cache_htm }
"/" -
"*.aspx" -
"*.asp" { STATS::incr my_stats_profile cache_asp }
"*.jpeg" -
"*.jpg" -
"*.gif" { STATS::incr my_stats_profile cache_img }
"*.css" { STATS::incr my_stats_profile cache_css }
"*.js" { STATS::incr my_stats_profile cache_js }
"*.pdf" { STATS::incr my_stats_profile cache_pdf }
"*.swf" { STATS::incr my_stats_profile cache_swf }
default { STATS::incr my_stats_profile cache_other }
}
}
}
----- END: my_stats_irule -----
For everything else there's tcpdump with offline analysis through tcptrace. :)