Thanks Aaron, you where on the right track...syslog doesn't terminate it's messages with CRLF, only with LF (my bad).
Converting to HEX helped figure this out, but now knowing this, it is not necessary to convert to HEX in the iRule.
So, here is a working iRule to load balance syslog-ng messages to multiple nodes in a pool -- while maintaining a persistent TCP session with the client.
when CLIENT_ACCEPTED {
TCP::collect
}
when CLIENT_DATA {
if { [TCP::payload] contains "\x0a" } {
LB::detach
TCP::release
TCP::collect
}
}
Also, with oneconnect enabled the TCP sessions are maintained to the backend nodes.
Thanks Again!
-Dan