AuditEvents are generated as a result of an action taken on the Server by a Client of the Server. For example, in response to a Client issuing a write to a Variable, the Server would generate an AuditEvent describing the Variable as the source and the user and Client Session as the initiators of the Event. Not all Servers support auditing, but if a Server supports auditing then it shall support audit Events as described in 5.6. Profiles (see OPC 10000-7) can be used to determine if a Server supports auditing. Servers shall generate Events of the AuditHistoryUpdateEventType or a sub-type of this type for all invocations of the HistoryUpdate Service on any HistoricalNode. See OPC 10000-3 and OPC 10000-5 for details on the AuditHistoryUpdateEventType model. In the case where the HistoryUpdate Service is invoked to insert Historical Events, the AuditHistoryEventUpdateEventType Event shall include the EventId of the inserted Event and a description that indicates that the Event was inserted. In the case where the HistoryUpdate Service is invoked to delete records, the AuditHistoryDeleteEventType or one of its sub-types shall be generated. See 6.8 for details on updating historical data or Events.

In particular using the Delete raw or Delete modified functionality shall generate an AuditHistoryRawModifyDeleteEventType Event or a sub-type of it. Using the Delete at time functionality shall generate an AuditHistoryAtTimeDeleteEventType Event or a sub-type of it. Using the Delete Event functionality shall generate an AuditHistoryEventDeleteEventType Event or a sub-type of it. All other updates shall follow the guidelines provided in the AuditHistoryUpdateEventType model.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of History Event update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 16.

Table 16 – AuditHistoryEventUpdateEventType definition

Attribute	Value
BrowseName	AuditHistoryEventUpdateEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasProperty	Variable	PerformInsertReplace	PerformUpdateType	PropertyType	Mandatory
HasProperty	Variable	Filter	EventFilter	PropertyType	Mandatory
HasProperty	Variable	NewValues	HistoryEventFieldList [ ]	PropertyType	Mandatory
HasProperty	Variable	OldValues	HistoryEventFieldList [ ]	PropertyType	Mandatory
ConformanceUnits
Historical Access Event Audit Events

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdateNode identifies the Attribute that was written on the SourceNode.

The PerformInsertReplace enumeration reflects the parameter on the Service call.

The Filter reflects the Event filter passed on the call to select the Events that are to be updated.

The NewValues identify the value that was written to the Event.

The OldValues identify the value that the Events contained before the update. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain Events with the appropriate fields, each with appropriately encoded values.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of history value update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 17.

Table 17 – AuditHistoryValueUpdateEventType definition

Attribute	Value
BrowseName	AuditHistoryValueUpdateEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasProperty	Variable	PerformInsertReplace	PerformUpdateType	PropertyType	Mandatory
HasProperty	Variable	NewValues	DataValue[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	DataValue[]	PropertyType	Mandatory
ConformanceUnits
Historical Access Data Audit Events

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdatedNode identifies the Attribute that was written on the SourceNode.

The PerformInsertReplace enumeration reflects the parameter on the Service call.

The NewValues identify the value that was written to the Event.

The OldValues identify the value that the Event contained before the write. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryUpdateEventType and is used the insertion or change of an annotation. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 18.

Table 18 – AuditHistoryAnnotationUpdateEventType definition

Attribute	Value
BrowseName	AuditHistoryAnnotationUpdateEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	PerformInsertReplace	PerformUpdateType	PropertyType	Mandatory
HasProperty	Variable	NewValues	Annotation[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	Annotation[]	PropertyType	Mandatory
ConformanceUnits
Historical Access Annotation Audit Events

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The PerformInsertReplace enumeration reflects the corresponding parameter on the Service call.

The NewValues identify the Annotation that was written. In the case of a remove, it is expected to be a null value.

The OldValues identify the value that the Annotation contained before the write. It is acceptable for a Server that does not have this information to report a null value in the case of an update. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 19.

Table 19 – AuditHistoryDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryDeleteEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryUpdateEventType defined in OPC 10000-3, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasSubtype	ObjectType	AuditHistoryRawModifyDeleteEventType
HasSubtype	ObjectType	AuditHistoryAtTimeDeleteEventType
HasSubtype	ObjectType	AuditHistoryEventDeleteEventType
ConformanceUnits
Historical Access Delete Raw Audit Events

This EventType inherits all Properties of the AuditUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdatedNode property identifies the NodeId that was used for the delete operation.

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 20.

Table 20 – AuditHistoryRawModifyDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryRawModifyDeleteEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryDeleteEventType defined in Table 19, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	IsDeleteModified	Boolean	PropertyType	Mandatory
HasProperty	Variable	StartTime	UtcTime	PropertyType	Mandatory
HasProperty	Variable	EndTime	UtcTime	PropertyType	Mandatory
HasProperty	Variable	OldValues	DataValue[]	PropertyType	Mandatory
ConformanceUnits
Historical Access Audit Delete Raw

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.8.5.

The isDeleteModified reflects the isDeleteModified parameter of the call.

The StartTime reflects the starting time parameter of the call.

The EndTime reflects the ending time parameter of the call.

The OldValues identify the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 21.

Table 21 – AuditHistoryAtTimeDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryAtTimeDeleteEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryDeleteEventType defined in Table 19, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	ReqTimes	UtcTime[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	DataValue[]	PropertyType	Mandatory
ConformanceUnits
Historical Access Audit Delete At Time

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.8.8.

The ReqTimes reflect the request time parameter of the call.

The OldValues identifies the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain a value in the DataType and encoding used for writing the value.

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 22.

Table 22 – AuditHistoryEventDeleteEventType definition

Attribute	Value
BrowseName	AuditHistoryEventDeleteEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditHistoryDeleteEventType defined in Table 19, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	EventIds	ByteString[]	PropertyType	Mandatory
HasProperty	Variable	OldValues	HistoryEventFieldList	PropertyType	Mandatory
ConformanceUnits
Historical Access Audit Delete Events

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.8.5.

The EventIds reflect the EventIds parameter of the call.

The OldValues identify the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain an Event with the appropriate fields, each with appropriately encoded values.

This is a subtype of AuditEventType and is used for categorization of history configuration changes. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 22.

Table 23 – AuditHistoryConfigurationChangeEventType definition

Attribute	Value
BrowseName	AuditHistoryConfigurationChangeEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in OPC 10000-5, i.e. it has HasProperty References to the same Nodes.
ConformanceUnits
Historical Access Audit Configuration Change Events

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in OPC 10000-5.

This is a subtype of AuditEventType and is used for tracking a bulk insertion of HistoricalData or HistoricalEvents into a Historian. This Event should not be generated for a given Node more frequently than once per minute, even if inserts occur more frequently.

This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined Table 24.

Table 24 – AuditHistoryBulkInsertEventType definition

Attribute	Value
BrowseName	AuditHistoryBulkInsertEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in OPC 10000-5, i.e. it has HasProperty References to the same Nodes.
HasProperty	Variable	UpdatedNode	NodeId	PropertyType	Mandatory
HasProperty	Variable	StartTime	UtcTime	PropertyType	Mandatory
HasProperty	Variable	EndTime	UtcTime	PropertyType	Mandatory
ConformanceUnits
Historical Access Audit BulkInsert Events

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in OPC 10000-5.

UpdatedNode is the NodeId that had a bulk insert of historical information. It might be a HistoricalDataNode or a HistoricalEventNode.

StartTime is the oldest time of the block that was inserted.

EndTime is the newest time of the block that was inserted.