time-taken (Explained)

By reading "W3C Extended Log File Format" page one could think that "time-taken" field measure the time from starting executing the request until first byte of response (they change that page later on) - meaning Execution time

Many people had this wrong understanding and Microsoft released a new KB that describes the behavior.

In a nut shell - the time-taken include the network time (time until last byte of response is acknowledged) if you don't have one of the following:

The response size is less than or equal to 2 KB
TCP buffering is used

Also don't forget that the first request to the site shows a slightly longer "time-taken" than other similar requests because HTTP.sys opens the log file with the first request.

Don't let the customer blame you for long execution time :) taken from W3C log file, investigate first.