Update log.c

fixes ossec/ossec-hids#348

Correct the custom replace string to be based correctly on dstuser.