Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to analyze IIS logs for some timeout issues that we see from time to time. Is IIS "time-taken" forward looking or reverse looking?

In other words, does "date"/"time" represent the time when the request started or the time when it completed?

share|improve this question
up vote 4 down vote accepted

The time when it completed.

Note: The value in the time-taken field does not include network time if one of the following conditions is true:

  • The response size is less than or equal to 2 KB, and the response size is from memory.
  • TCP buffering is used. Applications that use HTTPAPI.dll can set the HTTP_SEND_RESPONSE_FLAG_BUFFER_DATA flag to enable TCP buffering on Windows Server 2003 Service Pack 1 and later. This allows the server to send all of the response data to the client without having to wait for the client’s corresponding acknowledgements.

More information:

Description of the time-taken field in IIS 6.0 and IIS 7.0 HTTP logging

Also note that the csBytes and scBytes do not necessarily reflect the amount of data in the request. For example, a device may send a 3,500 character uriQuery, but the combined bytes may only be 1,000 bytes.

share|improve this answer

Date, time and time-taken are separate log fields, so which ones are you interested in exactly?

From the IIS Help:

Date (date): Logs the date on which the request occurred.

Time (time): Logs the time, in Coordinated Universal Time (UTC), at which the request occurred.

Time Taken (time-taken): Logs the length of time that the action took in milliseconds.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.