The difference is that
log "xxx"
uses the default log facility and level. Whereas you can specify the exact facility and level with
log facility.level "some text"
For a list of facilities and levels have a look at the docs for syslog-ng (Goog syslog-ng and it should keep you going for a while :). When you specify the facility and level yourself, you can determine where syslog-ng will write the logs (e.g. if you used an unused facility you could just send everything for his irule to your own file... Although admitedly you could also write a filter for that, so the explanation is probably a bit high-level :)
H
H