Home / server / Questions / 355542
In Process
justSteve
Asked: 2012-02-01 11:46:06 +0800 CST

Understanding the sUserTime field of an IIS logfile

  • 772

My IIS7x server is logging all fields to W3C format. I'm using LogParser and sending each row out to SQL for further analysis. After a few months worth of logging, each row finds a null value in sUserTime.

Under what conditions would some component within IIS or Windows write a value into sUserTime? I'd like to be sure it's always null so I can merge the currently separate 'Date' & 'Time' fields into it using an update statement that depends on 'is null' condition.

thx

logging iis-7.5

2 Answers

  1. Ok so you appear to be using Log Parser 2.2 which seems to be a generic log parser able to handle lots of different log formats, including IIS, Event logs, and several other common Microsoft log formats.

    The field you are looking sUserTime appears to be intended to be a measuremeant of how much time the processor spent in kernel mode while the logged item was being processed, the sKernelTime time is similar. AFAIK, neither of these should be relevant to parsed/imported IIS logs. This question covers some of the difference between user/kernel times.

    • 2

  2. The Log Parser 2.2 documentation notes that for the following fields:

    s-event, s-process-type, s-user-time, s-kernel-time, s-page-faults, s-total-procs, s-active-procs, s-stopped-procs

    this field is logged by IIS version 5.0 only when the "Process Accounting Logging" feature is enabled

    At first I thought the documentation might be old and might not have been updated to change the version of IIS but elsewhere on the same page it mentions IIS version 6.0 and later. So it looks like those fields only apply to IIS 5.0

    By the way, the Log Parser 2.2 documentation defines s-user-time as:

    The total accumulated User Mode processor time, in percentage, that the site used during the current interval

    • 0