Only IRULE_INIT events are triggerred

I don't see anything that would prevent logging to /var/log/ltm in the syslog-ng.conf. If the log line to local0. contained AUDIT, it would go to /var/log/audit. But your log lines don't contain that string.

 

 

Can you try clearing the rule stats, running curl -v 10.0.185.150 from the LTM command line and check the logs and rule stats again?

 

 

Thanks,

 

Aaron