Why is a lognormal distribution a good fit for server response times? I found out that webserver response times are typically modeled as coming from a lognormal distribution here. What I don't quite get is why this is the case!
In particular, Wikipedia states that a random variable X is distributed lognormally when it is the product of several independent normal variables.
In that case, what would these individual normal variables represent in the execution time of server code?
I haven't managed to find any sources that discuss why the lognormal distribution is a good fit for webserver response times.
Not sure if this question would be best asked on stackoverflow or math.stackexchange but thought I'd try here.
Thanks for any insight!
 A: You might be interested in reading the paper 

Vern Paxson. Empirically-Derived Analytic Models of
  Wide-Area TCP Connections. IEEE/ACM Transactions on Networking, 1994.

which is available online here. From the abstract:

We analyze 3 million TCP connections that occurred during
  15 wide-area traffic traces.  The traces were gathered at five
  “stub” networks and two internetwork gateways, providing a
  diverse look at wide-area traffic.  We derive analytic models
  describing the random variables associated with telnet, nntp, smtp, and ftp connections. 

and from the paper

For  most  connections  the  responder/duration  ratio  was well  modeled  by  an  exponential  distribution,  but  “large” connections—those whose responder bytes were in  the upper 10% of all connections—had a different distribution. For these, the ratio was fairly well modeled by a log-normal distribution.

Though, it is a bit dated already :-)
A: Say $X_1, \ldots X_n \overset{iid}{\sim} \text{something}$. You don't know the distribution but you don't need to. By the central limit theorem $\bar{X} \to \mathcal{N}$. Don't worry about the parameters. Then $\exp(\bar{X}) \to \text{lognormal}$. Last part: $Y_1 = \exp(\frac{\sum_i X_i}{n}) = \left[\exp(\sum_i X_i)\right] ^{1/n} = \left[\prod_i \exp X_i\right]^{1/n}$.
$Y_1$ is your first response time. I don't know anything about this stuff, but their justification for using this probably has something to do with this. Probably your response rate comes from an average of a gajillion unknown things coming from some unknown distribution.
