You certainly could - there are several different ways to accomplish what I have described. I chose this approach for two reasons. First, what's being logged in this article is based on iRules which are processed by the TMM process. TMM has been designated by F5 in syslog as facility local0, according to SOL5531. So using a different facility would contradict that designation. Secondly, our organization historically has tended to use the simple "log local0." statement in iRules. Customizing syslog and logrotate the way I have described allows us to continue using that standard.