the exact same as %S but prefers to use the Event-Timestamp VP if it's available. I found that when I use a detail file to decouple accounting the timestamp gets skewed if there is any kind of delay to relay the logs. This way the original timestamp of the event is used which I believe is more accurate. --- freeradius-server-2.1.10/src/main/xlat.c 2010-09-28 07:03:56.000000000 -0400 +++ freeradius/src/main/xlat.c 2010-12-17 14:42:31.000000000 -0500 @@ -1166,6 +1166,27 @@ } p++; break; + case 'E': /* Event-Timestamp (Original Timestamp from the NAS) + * falls back to local timestamp if the vp isn't in the packet + */ + tmp = pairfind(request->packet->vps,PW_EVENT_TIMESTAMP); + if (tmp) { + TM = localtime_r(&tmp->vp_date, &s_TM); + len = strftime(tmpdt, sizeof(tmpdt), "%Y-%m-%d %H:%M:%S", TM); + if (len > 0) { + strlcpy(q, tmpdt, freespace); + q += strlen(q); + } + } else { + TM = localtime_r(&request->timestamp, &s_TM); + len = strftime(tmpdt, sizeof(tmpdt), "%Y-%m-%d %H:%M:%S", TM); + if (len > 0) { + strlcpy(q, tmpdt, freespace); + q += strlen(q); + } + } + p++; + break; case 'H': /* request hour */ TM = localtime_r(&request->timestamp, &s_TM); len = strftime(tmpdt, sizeof(tmpdt), "%H", TM);