[jeffgrant]

Web logs only tell a small subset of the actual duration of a request from a browser.

What I've done in the past is set up some sort of network intrusion detection that detects and logs the life of the entire web request at the network layer, and then correlate that with the server web logs. In the case of internal queuing, or handler waits, etc., they won't show up in your typical web server logs because those only log the events once it actually gets to a handler. If there's a wait before that, it won't show it.

If you compare the web log duration/times with the lifespan of the socket from the ID logs, you may find a discrepancy.

Some of the stuff you have to set up to log explicitly in whatever OS you're using... like adding a specific IIS or kernel metric in the Windows Perf Log (or whatever the hell it's actually called).

$0.02

And yeah, I, too, am still getting sporadic waits, where it seem the request goes out, but up to 20 seconds for a reply.

I can do some packet sniffing/snarfing for you if you want to see what's going on from my end.