Old logs of backend nodes on F5

How old is the incident. Depending upon the logs that has been flowing in the respective F5, the logs get rotated/archived.

Try the 1st command to see how old files you could see. 

The second cmd checks the ip 1.1.1.1 (it could be assumed as node ip Or any ip as a matter of fact) in the uncompressed ltm files. 

The last cmd checks on the archived files. 

ls -ltrh /var/log/ltm*
cat /var/log/ltm* | grep 1.1.1.1
zcat /var/log/ltm* | grep 1.1.1.1

If you get zero hits, presumably the logs are rotated.