How to find a source IP that is overloading an FT LTM?

Shay, you have 3 options. 1) create a logging irule and apply to VIPs that are suspected of being hit during these spikes, 2) better still use High Speed Logging and log off box and 3) perhaps make use of AVR - i can't say too much on this as not used it much but would need provisioning and has overhead too.

Hope this helps,

Nathan