My IIS7x server is logging all fields to W3C format. I'm using LogParser and sending each row out to SQL for further analysis. After a few months worth of logging, each row finds a null value in sUserTime.

Under what conditions would some component within IIS or Windows write a value into sUserTime? I'd like to be sure it's always null so I can merge the currently separate 'Date' & 'Time' fields into it using an update statement that depends on 'is null' condition.


  • 2
    Are you sure that sUserTime is a valid W3C field? I've never heard of it – Mathias R. Jessen Jan 31 '12 at 20:02

Ok so you appear to be using Log Parser 2.2 which seems to be a generic log parser able to handle lots of different log formats, including IIS, Event logs, and several other common Microsoft log formats.

The field you are looking sUserTime appears to be intended to be a measuremeant of how much time the processor spent in kernel mode while the logged item was being processed, the sKernelTime time is similar. AFAIK, neither of these should be relevant to parsed/imported IIS logs. This question covers some of the difference between user/kernel times.


The Log Parser 2.2 documentation notes that for the following fields:

s-event, s-process-type, s-user-time, s-kernel-time, s-page-faults, s-total-procs, s-active-procs, s-stopped-procs

this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled

At first I thought the documentation might be old and might not have been updated to change the version of IIS but elsewhere on the same page it mentions IIS version 6.0 and later. So it looks like those fields only apply to IIS 5.0

By the way, the Log Parser 2.2 documentation defines s-user-time as:

The total accumulated User Mode processor time, in percentage, that the site used during the current interval

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.