anchor.diff:    <tr>
       <td><pre><code>
   database:
  -  type: REPLACE-WITH-DB-TYPE 
  +  type: REPLACE-WITH-DB-TYPE
     username: REPLACE-WITH-USERNAME
     password: REPLACE-WITH-PASSWORD
     host: REPLACE-WITH-DB-HOSTNAME
  -  port: REPLACE-WITH-DB-PORT 
  -  name: REPLACE-WITH-DB-NAME 
  +  port: REPLACE-WITH-DB-PORT
  +  name: REPLACE-WITH-DB-NAME
      </code></pre></td>
       <td>
       Supply the details for the database from <a href="#enable">step 1</a>.<br>
       The database type must be <code>postgres</code> or <code>mysql</code>.<br>
  -    Choose a username and password. 
  -    <br>For <code>host</code>, enter the IP address of the database instance. 
  +    Choose a username and password.
  +    <br>For <code>host</code>, enter the IP address of the database instance.
       <br>Supply a port; for MySQL a typical port is <code>3360</code>.
       <br>Supply the name of the database.
       </td>
     </tr>
  -<tr>
  +  <tr>
       <td><pre><code>
     ca_cert: |
       -----BEGIN CERTIFICATE-----
  
positive.code:         -----BEGIN RSA PRIVATE KEY-----
          REPLACE-WITH-CLIENT-KEY
          -----END RSA PRIVATE KEY-----</code></pre></td>
      <td>Copy in certificates and keys for the policy agent. 
          The policy agent communicates with the policy server through TLS. 
          See the <a href="#architecture">Architecture</a> section for more information.
      </td>
    </tr>
    <tr>
  
negative.code:  </li>
  </ol>
   
  ##<a id="logging"></a>Manage Logging for Container-to-Container Networking
  
  For debugging purposes, you can adjust the logging level on the Policy Server and VXLAN Policy Agent to generate more logs.
  
  You can enable logging for iptables policy rules by editing the manifest in [Enable on an IaaS](#iaas) above or by making a request to the VXLAN Policy Agent from the Diego cell.
  
  Container-to-container networking components can send metrics to the [Loggregator Firehose](../../loggregator/architecture.html#firehose).
  
  ###<a id="debug-logging"></a>Change Log Level for Debugging
  
  By default, the Policy Server logs events at the `INFO` level.
  You can capture more information about events by increasing the log level to `DEBUG`. 
  
  To change the log level, follow the steps below:
  
  1. SSH to either the Policy Server or the VXLAN Policy Agent.
      * **Policy Server**: SSH directly to the Policy Server VM.
      * **VXLAN Policy Agent**: SSH to the Diego cell that runs the VXLAN Policy Agent.
  
  1. To change the log level, run the following command:
  
      <pre>
      curl -X POST -d 'LOG-LEVEL' localhost:PORT-NUMBER/log-level
      </pre>
  
      The `LOG-LEVEL` is `DEBUG` or `INFO`. The `PORT-NUMBER` is `22222` unless you specified a different number when you edited the stub file in [Enable on an IaaS](#iaas) above.
      <br><br>
  
      The following command increases the log level to `DEBUG`:
      <pre class="terminal">
      $ curl -X POST -d 'DEBUG' localhost:22222/log-level
      </pre>
  
      The following command decreases the log level to `INFO`:
      <pre class="terminal">
      $ curl -X POST -d 'INFO' localhost:22222/log-level
      </pre>
  
  1. Find the logs in the following locations:
       * **Policy Server**: `/var/vcap/sys/log/policy-server/policy-server.stdout.log`
       * **VXLAN Policy Agent**: `/var/vcap/sys/log/vxlan-policy-agent/vxlan-policy-agent.stdout.log`
  
  ###<a id="iptables-logging"></a>Enable Logging for Container-to-Container Networking Policies
  
  By default, CF does not log iptables policy rules for container-to-container network traffic. You can enable logging for iptables policy rules
  in the manifest in [Enable on an IaaS](#iaas) above, or follow the steps below:
  
  1. SSH to the Diego cell that runs the VXLAN Policy Agent.
  
  1. To change the log level, run the following command:
  
      <pre>
      curl -X PUT -d '{"enabled": BOOLEAN}' localhost:PORT-NUMBER/iptables-c2c-logging
      </pre>
  
      The `BOOLEAN` is `true` or `false`. The `PORT-NUMBER` is `22222` unless you specified a different number when you edited the stub file in [Enable on an IaaS](#iaas) above.
      <br><br>
  
      The following command enables logging for iptables policy rules:
      <pre class="terminal">
      $ curl -X PUT -d '{"enabled": true}' localhost:22222/iptables-c2c-logging
      </pre>
  
      The following command disables logging for iptables policy rules:
      <pre class="terminal">
      $ curl -X PUT -d '{"enabled": false}' localhost:22222/iptables-c2c-logging
      </pre>
  
  1. Find the logs in `/var/log/kern.log`.
  
  ###<a id="metrics"></a>Use Metrics to Consume Logs
  
  You can stream container-to-container networking component metrics with the [Loggregator Firehose](../../loggregator/architecture.html#firehose).
  
  Container-to-container networking logs include the following prefixes:
  
  * `netmon`
  * `vxlan_policy_agent`
  * `policy_server`
  