Ok, I have a few results from the logs.
After getting a program that can handle the log files, Edit Pad Lite, I was able to view what appears to be duplicate, and our first Triple, POST entries.

These two lines occur at the time of purchase, back to back.
Code:
70.45.115.131 - - [27/Apr/2013:09:00:08 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR Enabled; SIMBAR={948EF965-EBC3-4e95-A9B5-E54E2F7B5B4A}; SIMBAR=0; FunWebProducts; GTB7.4; .NET CLR 1.1.4322; InfoPath.1; BRI/2)" "-"
Code:
70.45.115.131 - - [27/Apr/2013:09:00:18 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR Enabled; SIMBAR={948EF965-EBC3-4e95-A9B5-E54E2F7B5B4A}; SIMBAR=0; FunWebProducts; GTB7.4; .NET CLR 1.1.4322; InfoPath.1; BRI/2)" "-"
These two lines are from time of purchase and separated by 8 other log entries from 3 different users
Code:
96.248.6.178 - - [26/Apr/2013:14:37:41 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET4.0C; msn OptimizedIE8;ENUS)" "-"
Code:
96.248.6.178 - - [26/Apr/2013:14:37:52 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET4.0C; msn OptimizedIE8;ENUS)" "-"
These two are separated by 38 entries made by 1 other user
Code:
50.82.241.218 - - [22/Apr/2013:21:46:06 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" "-"
Code:
50.82.241.218 - - [22/Apr/2013:21:46:13 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" "-"
Here is a more recent one that is our first Triple! What's up with all of the 408's??
Code:
172.0.129.90 - - [14/May/2013:19:40:51 -0400] "POST /store/index.php?main_page=checkout_payment_address HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_payment_address" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "-"
Code:
172.0.129.90 - - [14/May/2013:19:42:43 -0400] "POST /store/index.php?main_page=checkout_confirmation HTTP/1.1" 200 31411 www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_payment" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "-"
Code:
172.0.129.90 - - [14/May/2013:19:44:26 -0400] "POST /store/index.php?main_page=checkout_process HTTP/1.1" 200 - www.mystore.com "https://www.mystore.com/store/index.php?main_page=checkout_confirmation" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "-"
Code:
172.0.129.90 - - [14/May/2013:19:43:06 -0400] "-" 408 - - "-" "-" "-"
172.0.129.90 - - [14/May/2013:19:43:06 -0400] "-" 408 - - "-" "-" "-"
172.0.129.90 - - [14/May/2013:19:44:47 -0400] "-" 408 - - "-" "-" "-"
172.0.129.90 - - [14/May/2013:19:46:34 -0400] "-" 408 - - "-" "-" "-"
172.0.129.90 - - [14/May/2013:19:47:48 -0400] "-" 408 - - "-" "-" "-"
172.0.129.90 - - [14/May/2013:19:47:48 -0400] "-" 408 - - "-" "-" "-"
What do you recommend that I look for?
The entries don't appear to be unusual that I can tell, but this is the first time I have looked at logs in this way.
We are getting complaints of slow order processing. We have also personally observed slow processing at times. But not every time...