Using the extended log format in IIS we're given the wonderful "time-taken" field.
Given this entry:
2013-06-03 02:00:00 188.8.131.52 GET /file.htm - 443 - 184.108.40.206 (User Agent) 200 0 0 300000
The time-taken is 300000ms, or 5 minutes.
My question is.. did the request begin at 02:00, or did the request begin at 01:55 and end at 02:00?
A Followup question.. if the timestamp represents the end of the request, are there any log parsers that automatically adjust the timestamp to represent the origin of the request?