UDP Traffic not switched

I suspect you are seeing monitoring traffic. I set up the following test:

Created a syslog-ng instance listening on two ports:

source s_net {
        udp(ip(10.0.0.194) port(514));
        udp(ip(10.0.0.180) port(514));
};

Created a virtual and pool pointing to it:

ltm virtual udp-test-vitual {
    destination 10.0.0.181:514
    ip-protocol udp
    mask 255.255.255.255
    pool udp-test
    profiles {
        udp { }
    }
    source 0.0.0.0/0
    vs-index 11
}
ltm pool udp-test {
    members {
        10.0.0.180:514 {
            address 10.0.0.180
            priority-group 100
            session monitor-enabled
            state up
        }
        10.0.0.194:514 {
            address 10.0.0.194
            session monitor-enabled
            state up
        }
    }
    monitor udp
}

I set up some traffic pointing to it:

while [ 1 ]; do logger -n 10.0.0.181 -P 514 "testing"; sleep 1; done

I then disabled the .180 listener and saw:

15:41:26.391592 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:26.989738 IP 10.0.0.194.51250 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:27.993237 IP 10.0.0.194.35184 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:28.995634 IP 10.0.0.194.56747 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:29.997998 IP 10.0.0.194.58083 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:30.398929 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:31.002259 IP 10.0.0.194.51332 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:31.400153 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:32.007825 IP 10.0.0.194.43167 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:33.010977 IP 10.0.0.194.50478 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:34.013450 IP 10.0.0.194.55872 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:35.015700 IP 10.0.0.194.47666 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:35.407133 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:36.020327 IP 10.0.0.194.39738 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:36.407760 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:37.023422 IP 10.0.0.194.41399 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:38.025852 IP 10.0.0.194.54688 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:39.030245 IP 10.0.0.194.44862 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:40.035572 IP 10.0.0.194.47855 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:40.412448 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:41.038749 IP 10.0.0.194.33010 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:41.312193 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:42.040993 IP 10.0.0.194.36688 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:43.045679 IP 10.0.0.194.40301 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:44.050950 IP 10.0.0.194.55865 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:45.054075 IP 10.0.0.194.40416 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:45.320777 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
----- Disabled listener here --------------------------------------------------------
15:41:46.056506 IP 10.0.0.194.37147 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:46.321038 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:47.061121 IP 10.0.0.194.42987 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:48.066190 IP 10.0.0.194.49487 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:49.069365 IP 10.0.0.194.55249 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:50.071796 IP 10.0.0.194.45676 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:50.326123 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:51.076485 IP 10.0.0.194.43712 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:51.326700 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:52.079590 IP 10.0.0.194.44853 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:53.082110 IP 10.0.0.194.53688 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:54.084631 IP 10.0.0.194.53723 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:55.088803 IP 10.0.0.194.52233 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:55.331950 IP 10.0.0.20.55542 > 10.0.0.180.514: [|syslog]
15:41:56.094137 IP 10.0.0.194.43624 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:56.333928 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:57.097979 IP 10.0.0.194.46896 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34

Monitor traffic continued. Real traffic stopped.