Problem with balancing rsyslog messages?

Hello,

Assuming you are sending as UDP and not TCP, This is the nature of UDP, it is a 'fire and forget protocol' F5 treats a connection as from the same IP address and port. This behavior can result in apparent, unequal load balancing. If you want to load balance UDP packets, you need to use a UDP Profile with the datagram LB option selected:

https://support.f5.com/csp/article/K3605

TCP connections will persist to a single pool member if you have a persistence profile, otherwise each connection will load balance to other pool members depending on the configured load blancing method.

I would advise configuring your syslogging servers to send as UDP and use an appropriate UDP profile on the virtual server rather than TCP, as this is much more efficient as TCP ACKs are not send back and forth.

Lee