F5 Different Logs Concepts--

If you are using the Syslog utility for local logging, whether or not you are using the high-speed logging mechanism you can view and manage the log messages, using the BIG-IP Configuration utility.

The local Syslog logs that the BIG-IP system can generate include several types of information. For example, some logs show a timestamp, host name, and service for each event. Moreover, logs sometimes include a status code, while the audit log shows a user name and a transaction ID corresponding to each configuration change. All logs contain a one-line description of each event.

For local log messages that the BIG-IP system stores in the local Syslog data base, the BIG-IP system automatically stores and displays log messages in these categories:

System messages
Packet filter messages
Local Traffic messages
Global Traffic messages
BIG-IP system configuration (audit) messages
Each type of event is stored locally in a separate log file, and the information stored in each log file varies depending on the event type. All log files for these event types are in the directory /var/log.

The product specific logs like /var/log/ltm, var/log/gtm, etc will contain debug info relative to that product. If you are logging from an irule you can define what log file you want to write your debug info into by specifying the local facility you chose.