Hello Dave -
On Saturday 27 October 2001 01:31, Dave Kitabjian wrote: > One question I've always had... > > Given an accounting record: > > Wed Mar 28 17:08:50 2001 > User-Name = "[EMAIL PROTECTED]" > Service-Type = Framed-User > NAS-IP-Address = 103.73.154.6 > NAS-Port = 1234 > NAS-Port-Type = Async > Acct-Session-Id = "00001234" > Acct-Status-Type = Stop > Acct-Delay-Time = 0 > Acct-Session-Time = 1000 > Acct-Input-Octets = 20000 > Acct-Output-Octets = 30000 > Timestamp = 985817330 > > Is the "Wed Mar 28 17:08:50 2001" the time when the record was logged, > whereas the "Timestamp = 985817330" is the actual time that the event > itself occurred? > Good question. No - in the case shown above, if you translate "985817330" you will find that it gives "Wed Mar 28 17:08:50 2001", which is the time that the Radiator host received the packet from the NAS (note that Radiator has no other source of clock time to go on). If the Acct-Delay-Time in the packet shown above was non-zero, then the Timestamp attribute will be corrected by subtracting that value from the time that the packet was received. In other words, a non-zero Acct-Delay-Time indicates that this is a retransmission of an event that occured that number of seconds prior to the retransmission being sent. hth Hugh -- Radiator: the most portable, flexible and configurable RADIUS server anywhere. Available on *NIX, *BSD, Windows 95/98/2000, NT, MacOS X. - Nets: internetwork inventory and management - graphical, extensible, flexible with hardware, software, platform and database independence. === Archive at http://www.open.com.au/archives/radiator/ Announcements on [EMAIL PROTECTED] To unsubscribe, email '[EMAIL PROTECTED]' with 'unsubscribe radiator' in the body of the message.