add note for new defaults

iis/configuration/system.applicationHost/sites/siteDefaults/logFile/index.md

@@ -150,7 +150,7 @@ The `<logFile>` element is included in the default installation of IIS 7 and lat
 | `enabled` | Optional Boolean attribute.<br><br>Specifies whether logging is enabled (**true**) or disabled (**false**) for a site.<br><br>**Note:** ASP and ODBC errors are not logged in the IIS log files.<br><br>The default value is `true`. |
 | `flushByEntryCountW3CLog` | Optional uint attribute.<br><br>Specifies the number of events to be stored in the buffer before they are flushed to the log file. A lower number will cause events to be flushed more quickly, at the cost of performance as a result of a greater number of disk operations. Reduce this value for more real-time troubleshooting, increase it for performance. A value of `0` specifies that the flush will occur at the default maximum of 64k.<br><br>The default value is `0`. |
 | `localTimeRollover` | Optional Boolean attribute.<br><br>Specifies whether a new log file is created based on local time or Coordinated Universal Time (UTC), which was previously called Greenwich Mean Time (GMT). When false, a new log file is created based on UTC.<br><br>**Note:** Regardless of the setting, the time stamp for each W3C Extended Logging log record is UTC-based.<br><br>The default value is `false`. |
-| `logExtFileFlags` | Optional flags attribute.<br><br>Specifies the categories of information that are written to either the log file (when you use W3C Extended log file format) or to the ODBC data source during logging events for a site. The **logExtFileFlags** attribute can be one or more of the following values. If you specify more than one value, separate them with a comma (,).<br><br>The default values are `Date`, `Time`, `ClientIP`, `UserName`, `ServerIP`, `Method`, `UriStem`, `UriQuery`, `TimeTaken`, `HttpStatus`, `Win32Status`, `ServerPort`, `UserAgent`, `HttpSubStatus`, `Referer`. <table> <tbody> <tr> <th>Value</th> <th>Description</th></tr> <tr> <th><code>BytesRecv</code></th> <td>Log the number of bytes that the server received.</td></tr> <tr> <th><code>BytesSent</code></th> <td>Log the number of bytes that the server sent.</td></tr> <tr> <th><code>ClientIP</code></th> <td>Log the IP address of the client that made the request.</td></tr> <tr> <th><code>ComputerName</code></th> <td>Log the name of the server on which the log file entry was generated.</td></tr> <tr> <th><code>Cookie</code></th> <td>Log the content of received cookies, if any content exists.</td></tr> <tr> <th><code>Date</code></th> <td>Log the date on which the activity occurred.</td></tr> <tr> <th><code>Host</code></th> <td>Log the host header name, if there is one.</td></tr> <tr> <th><code>HttpStatus</code></th> <td>Log the HTTP status code.</td></tr> <tr> <th><code>HttpSubStatus</code></th> <td>Log the sub-status code of the HTTP error. For example, for the 500.18 HTTP error, the status code is 500 and the sub-status code is 18.</td></tr> <tr> <th><code>Method</code></th> <td>Log the requested action. For example, <strong>GET</strong>, <strong>POST</strong>, etc.</td></tr> <tr> <th><code>ProtocolVersion</code></th> <td>Log the protocol version that the client used.</td></tr> <tr> <th><code>Referer</code></th> <td>Log the site that the user last visited. This site provided a link to the current site.</td></tr> <tr> <th><code>ServerIP</code></th> <td>Log the IP address of the server on which the log file entry was generated.</td></tr> <tr> <th><code>ServerPort</code></th> <td>Log the server port number that is configured for the site.</td></tr> <tr> <th><code>SiteName</code></th> <td>Log the Internet service name and instance number for the site.</td></tr> <tr> <th><code>Time</code></th> <td>Log the time in Coordinated Universal Time (UTC), at which the activity occurred.</td></tr> <tr> <th><code>TimeTaken</code></th> <td>Log the length of time taken for a request to be completed. The time taken is recorded in milliseconds.<br><br><strong>Note</strong>: The client-request timestamp is initialized when HTTP.sys receives the first byte, but before HTTP.sys begins to parse the request. The client-request timestamp is stopped when the last IIS send completion occurs. Time taken does not reflect time across the network. The first request to the site shows a slightly longer time taken than other similar requests because HTTP.sys opens the log file that contains the first request.</td></tr> <tr> <th><code>UriQuery</code></th> <td>Log the query, if any, that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages, and usually consists of parameters passed to the URL.</td></tr> <tr> <th><code>UriStem</code></th> <td>Log the Universal Resource Identifier (URI) stem information, which is the target of the action. For example, Default.htm.</td></tr> <tr> <th><code>UserAgent</code></th> <td>Log the browser type that the client used.</td></tr> <tr> <th><code>UserName</code></th> <td>Log the name of the authenticated user who accessed your server. Anonymous users are indicated by a hyphen.</td></tr> <tr> <th><code>Win32Status</code></th> <td>Log the Windows status code.</td></tr></tbody></table> |
+| `logExtFileFlags` | Optional flags attribute.<br><br>Specifies the categories of information that are written to either the log file (when you use W3C Extended log file format) or to the ODBC data source during logging events for a site. The **logExtFileFlags** attribute can be one or more of the following values. If you specify more than one value, separate them with a comma (,).<br><br>The default values are `Date`, `Time`, `ClientIP`, `UserName`, `ServerIP`, `Method`, `UriStem`, `UriQuery`, `TimeTaken`, `HttpStatus`, `Win32Status`, `ServerPort`, `UserAgent`, `HttpSubStatus`, `Referer`.<br><br>**Note:** Starting with the February 2026 Windows Update, `BytesRecv` and `BytesSent` are included by default in the **logExtFileFlags** attribute on Windows 11 and Windows Server 2019 and later.<br><br> <table> <tbody> <tr> <th>Value</th> <th>Description</th></tr> <tr> <th><code>BytesRecv</code></th> <td>Log the number of bytes that the server received.</td></tr> <tr> <th><code>BytesSent</code></th> <td>Log the number of bytes that the server sent.</td></tr> <tr> <th><code>ClientIP</code></th> <td>Log the IP address of the client that made the request.</td></tr> <tr> <th><code>ComputerName</code></th> <td>Log the name of the server on which the log file entry was generated.</td></tr> <tr> <th><code>Cookie</code></th> <td>Log the content of received cookies, if any content exists.</td></tr> <tr> <th><code>Date</code></th> <td>Log the date on which the activity occurred.</td></tr> <tr> <th><code>Host</code></th> <td>Log the host header name, if there is one.</td></tr> <tr> <th><code>HttpStatus</code></th> <td>Log the HTTP status code.</td></tr> <tr> <th><code>HttpSubStatus</code></th> <td>Log the sub-status code of the HTTP error. For example, for the 500.18 HTTP error, the status code is 500 and the sub-status code is 18.</td></tr> <tr> <th><code>Method</code></th> <td>Log the requested action. For example, <strong>GET</strong>, <strong>POST</strong>, etc.</td></tr> <tr> <th><code>ProtocolVersion</code></th> <td>Log the protocol version that the client used.</td></tr> <tr> <th><code>Referer</code></th> <td>Log the site that the user last visited. This site provided a link to the current site.</td></tr> <tr> <th><code>ServerIP</code></th> <td>Log the IP address of the server on which the log file entry was generated.</td></tr> <tr> <th><code>ServerPort</code></th> <td>Log the server port number that is configured for the site.</td></tr> <tr> <th><code>SiteName</code></th> <td>Log the Internet service name and instance number for the site.</td></tr> <tr> <th><code>Time</code></th> <td>Log the time in Coordinated Universal Time (UTC), at which the activity occurred.</td></tr> <tr> <th><code>TimeTaken</code></th> <td>Log the length of time taken for a request to be completed. The time taken is recorded in milliseconds.<br><br><strong>Note</strong>: The client-request timestamp is initialized when HTTP.sys receives the first byte, but before HTTP.sys begins to parse the request. The client-request timestamp is stopped when the last IIS send completion occurs. Time taken does not reflect time across the network. The first request to the site shows a slightly longer time taken than other similar requests because HTTP.sys opens the log file that contains the first request.</td></tr> <tr> <th><code>UriQuery</code></th> <td>Log the query, if any, that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages, and usually consists of parameters passed to the URL.</td></tr> <tr> <th><code>UriStem</code></th> <td>Log the Universal Resource Identifier (URI) stem information, which is the target of the action. For example, Default.htm.</td></tr> <tr> <th><code>UserAgent</code></th> <td>Log the browser type that the client used.</td></tr> <tr> <th><code>UserName</code></th> <td>Log the name of the authenticated user who accessed your server. Anonymous users are indicated by a hyphen.</td></tr> <tr> <th><code>Win32Status</code></th> <td>Log the Windows status code.</td></tr></tbody></table> |
 | `logFormat` | Optional enum attribute.<br><br>Specifies the log file format. The **logFormat** attribute can be one of the following values.<br><br>The default value is `W3C`. <table> <tbody> <tr> <th>Value</th> <th>Description</th></tr> <tr> <th><code>Custom</code></th> <td>Use a custom log file format for a custom logging module.<br><br>The numeric value is <code>3</code>.</td></tr> <tr> <th><code>IIS</code></th> <td>Use the Microsoft IIS log file format to log information about a site. This format is handled by HTTP.sys, and is a fixed ASCII text-based format, which means that you cannot customize the fields that are logged. Fields are separated by commas, and time is recorded as local time. The following list is a list of fields that are logged when you use the IIS log file format: <ul> <li><strong>Client IP address </strong></li> <li><strong>User name </strong></li> <li><strong>Date </strong></li> <li><strong>Time </strong></li> <li><strong>Service and instance </strong></li> <li><strong>Server name </strong></li> <li><strong>Server IP address </strong></li> <li><strong>Time taken </strong></li> <li><strong>Client bytes sent </strong></li> <li><strong>Server bytes sent </strong></li> <li><strong>Service status code</strong> (A value of 200 indicates that the request was fulfilled successfully.)</li> <li><strong>Windows status code</strong> (A value of 0 indicates that the request was fulfilled successfully.)</li> <li><strong>Request type </strong></li> <li><strong>Target of operation </strong></li> <li><strong>Parameters</strong> (the parameters that are passed to a script) </li></ul>Not all fields will contain data. When a field does not contain data, a hyphen (-) appears as a placeholder. When a field contains a non-printable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.<br><br>The numeric value is <code>0</code>.</td></tr> <tr> <th><code>NCSA</code></th> <td>Use the National Center for Supercomputing Applications (NCSA) Common log file format to log information about a site. This format is handled by HTTP.sys, and is a fixed ASCII text-based format, which means that you cannot customize the fields that are logged. Fields are separated by spaces, and time is recorded as local time with the Coordinated Universal Time (UTC) offset. The following list is a list of fields that are logged when you use the NCSA Common log file format: <ul> <li><strong>Remote host address </strong></li> <li><strong>Remote log name</strong> (This value is always a hyphen.)</li> <li><strong>User name </strong></li> <li><strong>Date, time, and UTC offset </strong></li> <li><strong>Request and protocol version </strong></li> <li><strong>Service status code</strong> (A value of 200 indicates that the request was fulfilled successfully.)</li> <li><strong>Bytes sent</strong> </li></ul>Not all fields will contain data. When a field does not contain data, a hyphen (-) appears as a placeholder. When a field contains a non-printable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.<br><br>The numeric value is <code>1</code>.</td></tr> <tr> <th><code>W3C</code></th> <td>Use the W3C Extended log file format to log information about a site. This format is handled by HTTP.sys, and is a customizable ASCII text-based format, which means that you specify the fields that are logged. Specify the fields that are logged in the <strong>logExtFileFlags</strong> attribute. Fields are separated by spaces, and time is recorded in Coordinated Universal Time (UTC).<br><br>The numeric value is <code>2</code>.</td></tr></tbody></table> |
 | `logSiteId` | Optional Boolean attribute.<br><br>Specifies that the s-sitename field will contain either the site name (false) or the site ID (true). If the One log file per property is set to `Site` (the out-of-box default], then you won't get s-sitename column in the log file by default, because the log file name property will contain the site ID instead. If the One log file per property is set to `Server`, the-s-sitename column will be included in the log file by default.<br><br>The default value is `True`, meaning that the s-sitename field contains the site ID. To log the site name instead, set logSiteID to `False`. |
 | `logTargetW3C` | Optional Flags attribute.<br><br>Specifies whether IIS will use Event Tracing for Windows (ETW) and/or file logging for processing logged IIS events. ETW provides real-time logging and use of an ETW provider and standard querying mechanisms. File logging stores event data in text files that you can parse to access logging data.<br><br>When IIS uses log files, HTTP.sys logs data directly into text log files after the transaction has completed. When using ETW, HTTP.sys sends data into ETW using the iislogging provider, and the LOGSVC service manages the log data, including querying ETW for data, gathering data directly from worker processes, and sending the data to a log file. <br><br>The `logTargetW3C` attribute can have the following possible values. The default value is `File`. If both `File` and `ETW` are listed for `logTargetW3C` for the server's log file defaults in applicationHost.config, that is equivalent to selecting **Both log file and ETW event** in the server's **Logging** pane in the IIS Manager. <table> <tbody> <tr> <th>Value</th> <th>Description</th></tr> <tr> <th><code>File</code></th> <td>IIS event data will be stored in a text log file. To process the event data, you must parse the text-based log file. Text log files take time to process and flush, so you will not be able to process the event data in real time. <br><br>The numeric value is <code>1</code>.</td></tr> <tr> <th><code>ETW</code></th> <td>Instead of logging data directly into text files, IIS will send logged information to Event Tracing for Windows, a generic event mechanism built into Windows. You can manage logged data using standard query tools, such as the Message Analyzer, or custom tools. ETW processes logged information in real time, and gives you the ability to filter and view the data, and to enable or disable logging, dynamically. ETW also adds detailed information to event data, providing data that HTTP.sys does not have access to. For more information, see <a href="/windows/win32/etw/event-tracing-portal">Event Tracing</a>. <br><br>The numeric value is <code>2</code>.</td></tr></tbody></table> |