AuditEvents are generated as a result of an action taken on the Server by a Client of the Server. For example, in response to a Client issuing a write to a Variable, the Server would generate an AuditEvent describing the Variable as the source and the user and Client Session as the initiators of the Event. Not all Servers support auditing, but if a Server supports auditing then it shall support audit Events as described in 5.6. Profiles (see OPC 10000-7) can be used to determine if a Server supports auditing. Servers shall generate Events of the AuditHistoryUpdateEventType or a sub-type of this type for all invocations of the HistoryUpdate Service on any HistoricalNode. See OPC 10000-3 and OPC 10000-5 for details on the AuditHistoryUpdateEventType model. In the case where the HistoryUpdate Service is invoked to insert Historical Events, the AuditHistoryEventUpdateEventType Event shall include the EventId of the inserted Event and a description that indicates that the Event was inserted. In the case where the HistoryUpdate Service is invoked to delete records, the AuditHistoryDeleteEventType or one of its sub-types shall be generated. See 6.7 for details on updating historical data or Events.

In particular using the Delete raw or Delete modified functionality shall generate an AuditHistoryRawModifyDeleteEventType Event or a sub-type of it. Using the Delete at time functionality shall generate an AuditHistoryAtTimeDeleteEventType Event or a sub-type of it. Using the Delete Event functionality shall generate an AuditHistoryEventDeleteEventType Event or a sub-type of it. All other updates shall follow the guidelines provided in the AuditHistoryUpdateEventType model.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of History Event update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 10.

Table 10 – AuditHistoryEventUpdateEventType definition

Attribute		Value
BrowseName		AuditHistoryEventUpdateEventType
IsAbstract		True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasProperty	Variable	PerformInsertReplace	PerformUpdateType	PropertyType	Mandatory
HasProperty	Variable	Filter	EventFilter	PropertyType	Mandatory
HasProperty	Variable	NewValues	HistoryEventFieldList [ ]	PropertyType	Mandatory
HasProperty	Variable	OldValues	HistoryEventFieldList [ ]	PropertyType	Mandatory

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdateNode identifies the Attribute that was written on the SourceNode.

The PerformInsertReplace enumeration reflects the parameter on the Service call.

The Filter reflects the Event filter passed on the call to select the Events that are to be updated.

The NewValues identify the value that was written to the Event.

The OldValues identify the value that the Events contained before the update. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain Events with the appropriate fields, each with appropriately encoded values.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of history value update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 11.

Table 11 – AuditHistoryValueUpdateEventType definition

Attribute	Value
BrowseName	AuditHistoryValueUpdateEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasProperty	Variable	PerformInsertReplace	PerformUpdateType	PropertyType	Mandatory
HasProperty	Variable	NewValues	DataValue[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	DataValue[]	PropertyType	Mandatory

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdatedNode identifies the Attribute that was written on the SourceNode.

The PerformInsertReplace enumeration reflects the parameter on the Service call.

The NewValues identify the value that was written to the Event.

The OldValues identify the value that the Event contained before the write. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of structured data update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 12.

Table 12 – AuditHistoryAnnotationUpdateEventType definition

Attribute	Value
BrowseName	AuditHistoryAnnotationUpdateEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	PerformInsertReplace	PerformUpdateType	PropertyType	Mandatory
HasProperty	Variable	NewValues	DataValue[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	DataValue[]	PropertyType	Mandatory

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The PerformInsertReplace enumeration reflects the coresponding parameter on the Service call.

The NewValues identify the Annotaion that was written. In the case of a remove it is expected to be a null value.

The OldValues identify the value that the Annotation contained before the write. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert or remove it is expected to be a null value.

Both the NewValues and the OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 13.

Table 13 – AuditHistoryDeleteEventType definition

Attribute		Value
BrowseName		AuditHistoryDeleteEventType
IsAbstract		True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasSubtype	ObjectType	AuditHistoryRawModifyDeleteEventType
HasSubtype	ObjectType	AuditHistoryAtTimeDeleteEventType
HasSubtype	ObjectType	AuditHistoryEventDeleteEventType

This EventType inherits all Properties of the AuditUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdatedNode property identifies the NodeId that was used for the delete operation.

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 14.

Table 14 – AuditHistoryRawModifyDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryRawModifyDeleteEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryDeleteEventType defined in Table 13, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	IsDeleteModified	Boolean	PropertyType	Mandatory
HasProperty	Variable	StartTime	UtcTime	PropertyType	Mandatory
HasProperty	Variable	EndTime	UtcTime	PropertyType	Mandatory
HasProperty	Variable	OldValues	DataValue[]	PropertyType	Mandatory

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.6.5.

The isDeleteModified reflects the isDeleteModified parameter of the call.

The StartTime reflects the starting time parameter of the call.

The EndTime reflects the ending time parameter of the call.

The OldValues identify the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 15.

Table 15 – AuditHistoryAtTimeDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryAtTimeDeleteEventType
IsAbstract	True
References		NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryDeleteEventType defined in Table 13, i.e. it has HasProperty References to the same Nodes.
HasProperty		Variable	ReqTimes	UtcTime[]	PropertyType	Mandatory
HasProperty		Variable	OldValues	DataValue[]	PropertyType	Mandatory

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.6.8.

The ReqTimes reflect the request time parameter of the call.

The OldValues identifies the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 16.

Table 16 – AuditHistoryEventDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryEventDeleteEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryDeleteEventType defined in Table 13, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	EventIds	ByteString[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	HistoryEventFieldList	PropertyType	Mandatory

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.6.5.

The EventIds reflect the EventIds parameter of the call.

The OldValues identify the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain an Event with the appropriate fields, each with appropriately encoded values.