By reading "W3C Extended Log File Format" page one could think that "time-taken" field measure the time from starting executing the request until first byte of response (they change that page later on) - meaning Execution time
Many people had this wrong understanding and Microsoft released a new KB that describes the behavior.
In a nut shell - the time-taken include the network time (time until last byte of response is acknowledged) if you don't have one of the following:
- The response size is less than or equal to 2 KB
- TCP buffering is used
Also don't forget that the first request to the site shows a slightly longer "time-taken" than other similar requests because HTTP.sys opens the log file with the first request.
Don't let the customer blame you for long execution time :) taken from W3C log file, investigate first.