Can you reproduce the issue? If so, I'd try capturing a tcpdump on LTM and use Fiddler2 to log the clientside HTTP. You can also add a debug event to the end of the iRule to log when a replacement is done:
From: http://devcentral.f5.com/wiki/default.aspx/iRules/stream__expression
Example which replaces http:// with https:// in response content
Prevents server compression in responses
when HTTP_REQUEST {
Disable the stream filter for all requests
STREAM::disable
set log_line "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host][HTTP::uri]"
log local0. $log_line
}
when HTTP_RESPONSE {
Check if response type is text
if {[HTTP::header value Content-Type] contains "text"}{
Replace http:// with https://
STREAM::expression {@http://@https://@}
Enable the stream filter for this response only
STREAM::enable
}
}
when STREAM_MATCHED {
log local0. "$log_line, matched [STREAM::match]"
}
Aaron