diff --git a/Shorewall/manpages/shorewall.xml b/Shorewall/manpages/shorewall.xml
index 574acf04f..9de7dbd16 100644
--- a/Shorewall/manpages/shorewall.xml
+++ b/Shorewall/manpages/shorewall.xml
@@ -1129,11 +1129,15 @@
           be one or more matches that may appear in both the raw table OUTPUT
           and raw table PREROUTING chains.</para>
 
-          <para>The trace records are written to the kernel's log buffer with
-          facility = kernel and priority = warning, and they are routed from
-          there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
-          Shorewall has no control over where the messages go; consult your
-          logging daemon's documentation.</para>
+          <para>When using ipt_LOG, the trace records are written to the
+          kernel's log buffer with facility = kernel and priority = warning,
+          and they are routed from there by your logging daemon (syslogd,
+          rsyslog, syslog-ng, ...). When using nfnetlink_log or ipt_ULOG, the
+          trace records go to ulogd.</para>
+
+          <para>In either case, Shorewall has no control over where the
+          messages are written; consult your logging daemon's
+          documentation.</para>
         </listitem>
       </varlistentry>
 
diff --git a/Shorewall6/manpages/shorewall6.xml b/Shorewall6/manpages/shorewall6.xml
index f9fbfd712..df52794e4 100644
--- a/Shorewall6/manpages/shorewall6.xml
+++ b/Shorewall6/manpages/shorewall6.xml
@@ -1012,11 +1012,15 @@
           be one or more matches that may appear in both the raw table OUTPUT
           and raw table PREROUTING chains.</para>
 
-          <para>The trace records are written to the kernel's log buffer with
-          facility = kernel and priority = warning, and they are routed from
-          there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
-          Shorewall has no control over where the messages go; consult your
-          logging daemon's documentation.</para>
+          <para>When using ipt6_LOG, the trace records are written to the
+          kernel's log buffer with facility = kernel and priority = warning,
+          and they are routed from there by your logging daemon (syslogd,
+          rsyslog, syslog-ng, ...). When using nfnetlink_log or ipt_ULOG, the
+          trace records go to ulogd.</para>
+
+          <para>In either case, Shorewall has no control over where the
+          messages written; consult your logging daemon's
+          documentation.</para>
         </listitem>
       </varlistentry>