Remote syslog not working with certain IP

Hi there,

 

We have a GTM BIG-IP 9.4.8 Build 355.0 Final. I have setup syslog to send logs to two remote servers as per the http://devcentral.f5.com/Tutorials/...ation.aspx topic. The appropriate entries are added to /etc/syslog-ng/syslog-ng.conf, however, some of the IP addresses do not seem to work. For example, this works:

 

 

destination remote_server { udp("10.1.3.101" port (514)); udp("10.1.3.102" port (514)); }; log { source(local); destination(remote_server); }; But this doesn't: destination remote_server { udp("10.1.3.101" port (514)); udp("10.0.3.101" port (514)); }; log { source(local); destination(remote_server); }; In the first example the syslogs are seen in a tcpdump outbound to both IP of the remote servers. In the second example, I am only seeing 10.1.3.101 in tcpdump? I posed a question to the syslog-ng folks but they did not think there were any limitations on IP addresses used. Has anyone else encountered this with their f5? Any ideas on why some IP work and others don't? Thanks in advance.