High # of transaction / TMM process not sending every log

I have several iRules - logging TCP connection specifics and then a few that parse XML and send to a syslog server to be parsed/indexed by Splunk.

 

 

Here is an example of the TCP iRule -

 

 

when CLIENT_ACCEPTED {

 

set tcp_start_time [clock clicks -milliseconds]

 

}

 

when CLIENT_CLOSED {

 

log -noname 10.66.48.45:514 local0.warning "DEVICE=SANPRODF5 ENV=PROD APP=CIDCSR COMMENT=TCP SRC=[IP::client_addr] SRCPORT=[TCP::client_port] DST=[IP::local_addr] DSTPORT=[TCP::local_port] OPEN=[expr [clock clicks -milliseconds] - $tcp_start_time]"

 

}

 

 

Recently been performing load tests (load runner) and the number of transactions from load runner don't jive with the syslog entries (about 30% off). I have been correlating other logs against iRule log entries and they are all off.

 

 

Using the iRule editor - I have been clearing/comparing the number of executions for "CLIENT_CLOSED" and that value compared to the syslog entires - those don't jive either.

 

 

Any else notice this issue?

 

 

Since an upgrade to v10 - I have been using HSL (high speed logging), but that doesn't seem to be helping either.