Time vs. Time-taken fields in IIS logging

 Cross-posted from https://blogs.msdn.com/webtopics

Questions often arise pertaining to what the Time-Taken and Time fields are reporting in the IIS logs.

The Time field is quite straightforward: it specifies when the log entry was created. Note that this is not always the same as when the log entry actually gets written to the log, as buffering can occur for some request/response scenarios.

The Time-Taken field shows the length of time that it takes for a request to be processed and its response to be sent. This value gets calculated by a timer that gets initialized when the IIS server receives the first byte of an HTTP request, and stopped when the last IIS response send operation completes. It is important to note that the Time-Taken field usually includes the time that the request and response packets are travelling over the network. For more detailed information, see this article:

Description of the time-taken field in IIS 6.0 and IIS 7.0 HTTP logging

https://support.microsoft.com/default.aspx?scid=kb;EN-US;944884

NOTE: If you wanted to calculate the approximate Start Time of a request, you would subtract the Time-Taken value from the Time value.