What we are seeing is that, because our systems are sending a near-constant volume of syslog, the "connection" (from the VIP to the box) is being retained. Even when we set the timeout to 1 second.
per the F5 documentation:
sol10430 shows below info about UDP traffic.
" UDP traffic
When multiple UDP datagrams are sent from the same IP address and port to a UDP virtual server, the BIG-IP system, by default, sends all datagrams that arrive within the Idle Timeout period configured in the associated UDP profile to the same pool member to which the preceding datagram from the same source was sent. This can result in uneven load balancing statistics across pool members."
We're still trying to crack this nut, but what it means is that once a box starts sending UDP to one of the Kiwi servers in the pool, it will ALWAYS send it to that kiwi server. (unless it stops sending for longer than the idle timeout).
Unless we find a different way to configure the F5's OR find another way to load-balance our syslog volume.