Re: Time

In message <Pine.SUN.3.91.960411165318.361D-100000@huygens>, Magnus Mengelbier 
>logging seconds since...
>1.  The question really comes down to the time resolution you need.  In an
>analysis, I can not see the need for time down to the second.

I can think of a few.

1) Given the start time and duration of a connection and the amount
of data transfered you can make estimates of how much bandwidth is
consumed by one or more web servers over various time peroids.
(this assumes the duration includes draining the TCP stream, or
you are willing to futz it).  I have code that does this.  It wasn't
all that far off from what the code I later inserted into the kernel
to gather the same data (and do other things).

2) Your web server keeps crashing.  Wouldn't it be nice to find out if
it was processing a whole lot more requests in the last few seconds
leading up to the crash?

3) Someone is doing proformance testing on your product.  You want to
make sure they don't misreprsent your product...

>                                                               Since a 
>log is sequential,

Sequental with respect to request start times, or request end times?

>                   I think that time down to the minute is enough.  A 
>users rewquest within 59 seconds usually means they know more or less 
>what they want and any more precise time is ancillary. 

On the other hand it could also be argued that you want sub-second
accuracy.  (personally I'll be happy with seconds, that's what I have
now, and I don't really need it to be much better -- however if anyone
else does they should speak up!)

>2. If not all servers are running exactly the same time it can be
>misleading to log seconds if we start to combine logs from different servers. 

If a site wants the servers to have sync'ed clocks they can run ntp.
For a rather small cost (less then 1% of the CPU, something like two
UDP packets per minute) it can keep times wo with in 30 milliseconds
or so of each other.

>Also, what time is logged?  The beginning or the termination of the 
>request?  It might be wise to have both times. 

I thought request start time and request duration (as a float) were
both defined.  However request end time + duration would also be
Ok.  If the accuracy on times was sub-second request end & start
w/ no duration would also be Ok.