Cant collect syslog data on my syslog server

I would suggest using the CLI, yes. Some versions of the BigIP will allow you to run a tcpdump from the web interface, but you have very little control that way. I would suggest the /var/tmp directory which has a fair amount of room on it. I would suggest the following:

tcpdump -s0 -i 0.0:nnn -w /var/tmp/ host

-s0 = don't truncate the packets -i 0.0:nnn = capture on all VLANs and add f5 specific data to the packets (support will want this if you end up opening a case) -w = write to a file, not the screen

If you don't see what you're looking for there you can substitute

tcpdump -s0 -i eth0 -w /var/tmp/ host

Which will capture on the management port. Make sure you replace filename with an actual filename and with the IP you want to watch.