Description of the time-taken field in IIS 6.0 and IIS 7.0 HTTP logging


This article describes the functionality of the time-taken field in Internet Information Services (IIS) 6.0 and IIS 7.0 HTTP logging.

More Information

By default, IIS logs HTTP site activity by using the W3C Extended log file format. You can use IIS Manager to select the fields to include in the log file. One of these fields is the time-taken field.

The time-taken field measures the length of time that it takes for a request to be processed. The client-request time stamp is initialized when HTTP.sys receives the first byte of the request. HTTP.sys is the kernel-mode component that is responsible for HTTP logging for IIS activity. The client-request time stamp is initialized before HTTP.sys begins parsing the request. The client-request time stamp is stopped when the last IIS response send completion occurs.

Beginning in IIS 6.0, the time-taken field typically includes network time. Before HTTP.sys logs the value in the time-taken field, HTTP.sys usually waits for the client to acknowledge the last response packet send operation or HTTP.sys waits for the client to reset the underlying TCP connection. Therefore, when a large response or large responses are sent to a client over a slow network connection, the value of the time-taken field may be more than expected.

Note The value in the time-taken field does not include network time if one of the following conditions is true:
  • The response size is less than or equal to 2 KB, and the response size is from memory.
  • TCP buffering is used. Applications that use HTTPAPI.dll can set the HTTP_SEND_RESPONSE_FLAG_BUFFER_DATA flag to enable TCP buffering on Windows Server 2003 Service Pack 1 and later. This allows the server to send all of the response data to the client without having to wait for the client’s corresponding acknowledgements.


For more information, click the following article number to view the article in the Microsoft Knowledge Base:

324279 How to configure Web site logging in Windows Server 2003

For more information about the W3C Extended log file format, visit the following Microsoft TechNet Web site: