Understanding the Time-Taken value in the Access logs
Time taken (in milliseconds) to process the request
The counter start when the proxy received the first bytes of the request and starts an proxy transaction.
It includes all the DNS queries, ICAP scanning, Authentication, ProxySG to OCS and OCS to client until the last response byte is sent to the client.
Since it includes all these activities, this value will be slightly different from the other networking tracking tools but this is the best way to track the overall latency from the time client initiates the request.
The time-taken field will often show a very large value for transactions that are tunneled.
For a tunnel, the time-taken field will measure the entire duration of the tunneled connection, as the tunneled connection will essentially be one long transaction from an access log point of view.