Better explanation

tigera · Nov 20, 2024 · ed4016f · ed4016f
1 parent a02d36c
commit ed4016f
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/calico/network-policy/policy-rules/log-rules.mdx b/calico/network-policy/policy-rules/log-rules.mdx
@@ -26,15 +26,19 @@ import TabItem from '@theme/TabItem';
 </TabItem>
 
 <TabItem label="iptables/ipvs" value="iptables">
-    - Rsyslogd
-
+
     :::note
 
     In a containerized Kubernetes environment, such as Kind, sending `syslog` messages to the Kernel is not permitted. This limitation is by the design to prevent a noisy neighbor scenario since both containers and the host share the same Kernel.
 
     :::
 
-    Iptable logs are sent to the syslog.
+    The $[prodname] Log action creates a LOG rule in iptables. Any logs matching this rule are recorded by the kernel's logging service, usually through syslog.
+
+    The following suffix, is an example of iptables LOG ruled programmed by $[prodname]:
+    ```bash
+    -j LOG --log-prefix "calico-packet: " --log-level 5
+    ```
 
 </TabItem>
 </Tabs>
@@ -80,7 +84,7 @@ curl-5288    [000] ..s2.  3055.982021: bpf_trace_printk: cali527b0801ecb-E: poli
 
 </TabItem>
 <TabItem label="iptables/ipvs" value="iptables">
-The $[prodname] `Log` action generates a `LOG` rule in iptables. The location and method for accessing these logs can vary depending on your Linux distribution. By default, $[prodname] prefixes these log entries with `calico-packet`, making it easier to filter them.
+By default, $[prodname] prefixes these log entries with `calico-packet`, making it easier to filter them. The location and method for accessing these logs can vary depending on your Linux distribution.
 
 The following commands are some of the usual places that you can search for the policy log outputs:
 ```bash