Hey Eric!
1. Does the F5, by default, use the management IP address as the source?
The correct answer is, it depends.
The interface being used is dependent on the Local IP being used when configuring remote logging. This is set under System > Logs > Configuration > Remote Logging.
The second issue is that the interface selected to reach the syslog server will follow the IP route table. The TMM routes are copied into the linux routing table, so if you have a tmm default route (network / routes), and the syslog server is not directly connected, then this route will be used, and the self-ip on the outbound interface will be the source address.
To determine which one being used, check out this link:
Determining the interface that the BIG-IP system uses to reach the remote syslog server
2. Is there a document that covers the basics of how to configure the F5 to send syslog messages?
I think this should cover it all:
K13080: Configuring the BIG-IP system to log to a remote syslog server (10.x - 13.x)
3. I may need to modify the message being sent. Document that covers that as well?
I think the previous link covers some syslog modifications here:
Configuring the BIG-IP system to log to the remote syslog server using TCP protocol
Otherwise this might be helpful:
K13333: Filtering log messages sent to remote syslog servers (11.x - 13.x)
I hope this helps! :)
Nimbostratus
