Could you recommend the syslog-ng guide in the above situation?

Hi Hooni_L, I'd recommend the setup in this guide: https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-external-monitoring-implementations-12-0-0/9.html. 12.x is many major versions behind so some of the steps might be slightly different now, but the overall setup is the same. If you use the native TMOS objects through GUI or tmsh, you shouldn't need to touch the daemons. If you change the system files themselves in what you are tweaking, you will likely need to restart syslog-ng daemon, and make sure you have an ops procedure in place for patches/upgrades as the changes you make will likely not persist.

Hi JRahm, thank you for recommend guide.

So, and I found the sol document.

https://my.f5.com/manage/s/article/K00743330

F5 need to restart the syslog-ng deamon when I change routing.

thanks,