Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My IIS7x server is logging all fields to W3C format. I'm using LogParser and sending each row out to SQL for further analysis. After a few months worth of logging, each row finds a null value in sUserTime.

Under what conditions would some component within IIS or Windows write a value into sUserTime? I'd like to be sure it's always null so I can merge the currently separate 'Date' & 'Time' fields into it using an update statement that depends on 'is null' condition.

thx

share|improve this question
2  
Are you sure that sUserTime is a valid W3C field? I've never heard of it –  Mathias R. Jessen Jan 31 '12 at 20:02

2 Answers 2

Ok so you appear to be using Log Parser 2.2 which seems to be a generic log parser able to handle lots of different log formats, including IIS, Event logs, and several other common Microsoft log formats.

The field you are looking sUserTime appears to be intended to be a measuremeant of how much time the processor spent in kernel mode while the logged item was being processed, the sKernelTime time is similar. AFAIK, neither of these should be relevant to parsed/imported IIS logs. This question covers some of the difference between user/kernel times.

share|improve this answer

The Log Parser 2.2 documentation notes that for the following fields:

s-event, s-process-type, s-user-time, s-kernel-time, s-page-faults, s-total-procs, s-active-procs, s-stopped-procs

this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled

At first I thought the documentation might be old and might not have been updated to change the version of IIS but elsewhere on the same page it mentions IIS version 6.0 and later. So it looks like those fields only apply to IIS 5.0

By the way, the Log Parser 2.2 documentation defines s-user-time as:

The total accumulated User Mode processor time, in percentage, that the site used during the current interval

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.