User access related Syslog message for F5 Big IP LTM

For BIG-IP events, the system routes messages through syslog-ng to the local log files. For access to the system, you would be most interested in /var/log/ltm. Also review /var/log/audit, /var/log/secure.

For other log files and what they mean, refer to K16197: Reviewing BIG-IP log files

If you'd like to have the logs at a remote server, or consolidate the logs from multiple BIG-IP systems, you can configure BIG-IP to log to a remote server. Refer to:

K13080: Configuring the BIG-IP system to log to a remote syslog server (11.x - 15.x)

K13333: Filtering log messages sent to remote syslog servers (11.x - 15.x)

and if things don't work:

K86480148: Troubleshooting issues sending logs to a remote syslog server

Let me know if this doesn't address your query.