patch for src/main/xlat.c

[Alan DeKok]

Gabriel Blanchard wrote:
> the exact same as %S but prefers to use the Event-Timestamp VP if it's available.
> 
> I found that when I use a detail file to decouple accounting the timestamp gets skewed if there is any kind of delay to relay the logs. This way the original timestamp of the event is used which I believe is more accurate.

  It's easier to hack the detail file reader to use Event-Timestamp,
instead of the artificial "Timestamp" field.

  i.e. the time when the "event" happened is (a) Event-Timestamp, or (b)
if that doesn't exist, the time when the packet was written to the
detail file.

  The Acct-Delay-Time is the different between now and the time from above.

  Alan DeKok.