tcpdump/Logging on vip for 1 week.

If all you need is to capture the client IP I would say tcpdump is overkill as you could simply log the IP address via an iRule and simply assign it to each Virtual Server to want to log.

The following iRule would log remotely to a syslog server in

172.27.31.10

when CLIENT_ACCEPTED {
   log 172.27.31.10 local0.info "Client Connected, IP: [IP::client_addr]"
}

If you wanted to log locally simply remove the remote IP from the

log

/var/log/ltm