Understanding the sUserTime field of an IIS logfile

Question

My IIS7x server is logging all fields to W3C format. I'm using LogParser and sending each row out to SQL for further analysis. After a few months worth of logging, each row finds a null value in sUserTime.

Under what conditions would some component within IIS or Windows write a value into sUserTime? I'd like to be sure it's always null so I can merge the currently separate 'Date' & 'Time' fields into it using an update statement that depends on 'is null' condition.

thx

Answer 1

Ok so you appear to be using Log Parser 2.2 which seems to be a generic log parser able to handle lots of different log formats, including IIS, Event logs, and several other common Microsoft log formats.

The field you are looking sUserTime appears to be intended to be a measuremeant of how much time the processor spent in kernel mode while the logged item was being processed, the sKernelTime time is similar. AFAIK, neither of these should be relevant to parsed/imported IIS logs. This question covers some of the difference between user/kernel times.