IIS Log Timestamp Question
Posted on 2013-06-04
Using the extended log format in IIS we're given the wonderful "time-taken" field.
Given this entry:
2013-06-03 02:00:00 22.214.171.124 GET /file.htm - 443 - 126.96.36.199 (User Agent) 200 0 0 300000
The time-taken is 300000ms, or 5 minutes.
My question is.. did the request begin at 02:00, or did the request begin at 01:55 and end at 02:00?
A Followup question.. if the timestamp represents the end of the request, are there any log parsers that automatically adjust the timestamp to represent the origin of the request?