This document defines standard EventTypes. They are represented in the AddressSpace as ObjectTypes. The EventTypes are already defined in OPC 10000-3. The following subclauses specify their representation in the AddressSpace.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 24.

Table 24 – BaseEventType definition

Attribute		Value
BrowseName		BaseEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseObjectType defined in 6.2
HasProperty	Variable		EventId	ByteString	PropertyType	Mandatory
HasProperty	Variable		EventType	NodeId	PropertyType	Mandatory
HasProperty	Variable		SourceNode	NodeId	PropertyType	Mandatory
HasProperty	Variable		SourceName	String	PropertyType	Mandatory
HasProperty	Variable		Time	UtcTime	PropertyType	Mandatory
HasProperty	Variable		ReceiveTime	UtcTime	PropertyType	Mandatory
HasProperty	Variable		LocalTime	TimeZoneDataType	PropertyType	Optional
HasProperty	Variable		Message	LocalizedText	PropertyType	Mandatory
HasProperty	Variable		Severity	UInt16	PropertyType	Mandatory
HasProperty	Variable		ConditionClassId	NodeId	PropertyType	Optional
HasProperty	Variable		ConditionClassName	LocalizedText	PropertyType	Optional
HasProperty	Variable		ConditionSubClassId	NodeId[]	PropertyType	Optional
HasProperty	Variable		ConditionSubClassName	LocalizedText[]	PropertyType	Optional
Conformance Units
Address Space Events

EventId is generated by the Server to uniquely identify a particular Event Notification. The Server is responsible to ensure that each Event has its unique EventId. It may do this, for example, by putting GUIDs into the ByteString. Clients can use the EventId to assist in minimizing or eliminating gaps and overlaps that may occur during a redundancy failover. The EventId shall always be returned as value and the Server is not allowed to return a StatusCode for the EventId indicating an error.

EventType describes the specific type of Event. The EventType shall always be returned as value and the Server is not allowed to return a StatusCode for the EventType indicating an error.

The SourceNode Property identifies the Node that the Event originated from. If the Event is not specific to a Node the NodeId is set to null. Some subtypes of this BaseEventType may define additional rules for the SourceNode Property.

SourceName provides a description of the source of the Event. This could be the string-part of the DisplayName of the Event source using the default locale of the server, if the Event is specific to a Node, or some server-specific notation.

Time provides the time the Event occurred. This value is set as close to the event generator as possible. It often comes from the underlying system or device. Once set, intermediate OPC UA Servers shall not alter the value.

ReceiveTime provides the time the OPC UA Server received the Event from the underlying device of another Server. ReceiveTime is analogous to ServerTimestamp defined in OPC 10000-4, i.e. in the case where the OPC UA Server gets an Event from another OPC UA Server, each Server applies its own ReceiveTime. That implies that a Client may get the same Event, having the same EventId, from different Servers having different values of the ReceiveTime. The ReceiveTime shall always be returned as value and the Server is not allowed to return a StatusCode for the ReceiveTime indicating an error.

LocalTime is a structure containing the Offset and the DaylightSavingInOffset flag. The Offset specifies the time difference (in minutes) between the Time Property and the time at the location in which the event was issued. If DaylightSavingInOffset is TRUE, then Standard/Daylight savings time (DST) at the originating location is in effect and Offset includes the DST correction. If FALSE then the Offset does not include DST correction and DST may or may not have been in effect.

Message provides a human-readable and localizable text description of the Event. The Server may return any appropriate text to describe the Event. A null string is not a valid value; if the Server does not have a description, it shall return the string part of the BrowseName of the Node associated with the Event.

Severity is an indication of the urgency of the Event. This is also commonly called "priority". Values will range from 1 to 1 000, with 1 being the lowest severity and 1 000 being the highest. Typically, a severity of 1 would indicate an Event which is informational in nature, while a value of 1 000 would indicate an Event of catastrophic nature, which could potentially result in severe financial loss or loss of life.

It is expected that very few Server implementations will support 1 000 distinct severity levels. Therefore, Server developers are responsible for distributing their severity levels across the 1 to 1 000 range in such a manner that clients can assume a linear distribution. For example, a client wishing to present five severity levels to a user should be able to do the following mapping:

Client Severity	OPC Severity
HIGH	801 to 1 000
MEDIUM HIGH	601 to 800
MEDIUM	401 to 600
MEDIUM LOW	201 to 400
LOW	1 to 200

In many cases a strict linear mapping of underlying source severities to the OPC Severity range is not appropriate. The Server developer will instead intelligently map the underlying source severities to the 1 to 1 000 OPC Severity range in some other fashion. In particular, it is recommended that Server developers map Events of high urgency into the OPC severity range of 667 to 1 000, Events of medium urgency into the OPC severity range of 334 to 666 and Events of low urgency into OPC severities of 1 to 333.

For example, if a source supports 16 severity levels that are clustered such that severities 0 to 2 are considered to be LOW, 3 to 7 are MEDIUM and 8 to 15 are HIGH, then an appropriate mapping might be as follows:

OPC Range	Source Severity	OPC Severity
HIGH (667 to 1 000)	15	1 000
	14	955
	13	910
	12	865
	11	820
	10	775
	9	730
	8	685
MEDIUM (334 to 666)	7	650
	6	575
	5	500
	4	425
	3	350
LOW (1 to 333)	2	300
	1	150
	0	1

Some Servers might not support any Events which are catastrophic in nature, so they may choose to map all of their severities into a subset of the 1 to 1 000 range (for example, 1 to 666). Other Servers might not support any Events which are merely informational, so they may choose to map all of their severities into a different subset of the 1 to 1 000 range (for example, 334 to 1 000).

The purpose of this approach is to allow clients to use severity values from multiple Servers from different vendors in a consistent manner. Additional discussions of severity can be found in OPC 10000-9.

ConditionClassId specifies in which domain this Event is used. It is the NodeId of the corresponding subtype of BaseConditionClassType. See OPC 10000-9 for the definition of ConditionClass and a set of ConditionClasses defined in this standard. When using this Property for filtering, Clients have to specify all individual subtypes of BaseConditionClassType NodeIds. The OfType operator cannot be applied. BaseConditionClassType is used as class whenever an Event cannot be assigned to a more concrete class.

ConditionClassName provides the DisplayName of the of the ConditionClassType provided in the ConditionClassId.

ConditionSubClassId specifies additional class[es] that apply to the Event. It is the NodeId of the corresponding subtype of BaseConditionClassType. See OPC 10000-9 for the definition of ConditionClass and a set of ConditionClasses defined in this standard. When using this Property for filtering, Clients have to specify all individual sub types of BaseConditionClassType NodeIds. The OfType operator cannot be applied. The Client specifies a NULL in the filter, to return Events where no sub class is applied. When returning Events, if this optional field is not available in an Event, a NULL shall be returned for the field.

ConditionSubClassName provides the DisplayName[s] of the ConditionClassType[s] listed in the ConditionSubClassId.

The BrowseNames of the ConditionClassId, ConditionClassName, ConditionSubClassId, and ConditionSubClassName Properties originated from OPC 10000-9. They have now been generalized to also apply to Events, however to preserve backward compatibility the names have been preserved.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 25.

Table 25 – AuditEventType definition

Attribute		Value
BrowseName		AuditEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		ActionTimeStamp	UtcTime	PropertyType	Mandatory
HasProperty	Variable		Status	Boolean	PropertyType	Mandatory
HasProperty	Variable		ServerId	String	PropertyType	Mandatory
HasProperty	Variable		ClientAuditEntryId	String	PropertyType	Mandatory
HasProperty	Variable		ClientUserId	String	PropertyType	Mandatory
Conformance Units
Auditing Connections
Auditing NodeManagement
Auditing History Services
Auditing Write
Auditing Method

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2.

ActionTimeStamp identifies the time the user initiated the action that resulted in the AuditEvent being generated. It differs from the Time Property because this is the time the server generated the AuditEvent documenting the action.

Status identifies whether the requested action could be performed (set Status to TRUE) or not (set Status to FALSE).

ServerId uniquely identifies the Server generating the Event. It identifies the Server uniquely even in a server-controlled transparent redundancy scenario where several Servers may use the same URI.

ClientAuditEntryId contains the human-readable AuditEntryId defined in OPC 10000-4. If the Server is unable to decrypt AuditEntryId due to a certificate check failure, then some Client identification should be used such as the Client’s IP Address, port, MAC address and/or DNS name as the ClientAuditEntryId.

The ClientUserId identifies the user of the client requesting an action. The ClientUserId can be obtained from the UserIdentityToken passed in the ActivateSession call. If the UserIdentityToken is a UserNameIdentityToken then the ClientUserId is the UserName. If the UserIdentityToken is an X509IdentityToken then the ClientUserId is the X509 Subject Name of the Certificate. If the UserIdentityToken is an IssuedIdentityToken then the ClientUserId shall be a string that represents the owner of the token. The best choice for the string depends on the type of IssuedIdentityToken. If an AnonymousIdentityToken was used, the value is null. For a SessionlessInvoke Service invocation the ClientUserId shall be a string that represents the owner of the authenticationToken in the requestHeader of the Service invocation such as the name field of a JWT IssuedIdentityToken.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 26.

Table 26 – AuditSecurityEventType definition

Attribute		Value
BrowseName		AuditSecurityEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		StatusCodeId	StatusCode	PropertyType	Optional
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3.

The optional StatusCodeId Property provides the exact security error responsible for producing the Event.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 27.

Table 27 – AuditChannelEventType definition

Attribute	Value
BrowseName	AuditChannelEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditSecurityEventType defined in 6.4.4, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable	SecureChannelId	String	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSecurityEventType. Their semantic is defined in 6.4.4. The SourceNode Property for Events of this type shall be assigned to the Server Object. The SourceName for Events of this type shall be "SecureChannel/" and the Service that generates the Event (e.g. SecureChannel/OpenSecureChannel or SecureChannel/CloseSecureChannel). If the ClientUserId is not available for a CloseSecureChannel call, then this parameter shall be set to "System/CloseSecureChannel".

The SecureChannelId shall uniquely identify the SecureChannel. The application shall use the same identifier in all AuditEvents related to the Session Service Set (AuditCreateSessionEventType, AuditActivateSessionEventType and their subtypes) and the SecureChannel Service Set (AuditChannelEventType and its subtypes).

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 28.

Table 28 – AuditOpenSecureChannelEventType definition

Attribute		Value
BrowseName		AuditOpenSecureChannelEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditChannelEventType defined in 6.4.5, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		ClientCertificate	ByteString	PropertyType	Mandatory
HasProperty	Variable		ClientCertificateThumbprint	String	PropertyType	Mandatory
HasProperty	Variable		RequestType	SecurityTokenRequestType	PropertyType	Mandatory
HasProperty	Variable		SecurityPolicyUri	String	PropertyType	Mandatory
HasProperty	Variable		SecurityMode	MessageSecurityMode	PropertyType	Mandatory
HasProperty	Variable		RequestedLifetime	Duration	PropertyType	Mandatory
HasProperty	Variable		CertificateErrorEventId	ByteString	PropertyType	Optional
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditChannelEventType. Their semantic is defined in 6.4.5. The SourceName for Events of this type shall be "SecureChannel/OpenSecureChannel". The ClientUserId is not available for this call, thus this parameter shall be set to "System/OpenSecureChannel".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ClientCertificate is the clientCertificate parameter of the OpenSecureChannel Service call.

ClientCertificateThumbprint is a thumbprint of the ClientCertificate. See OPC 10000-6 for details on thumbprints.

RequestType is the requestType parameter of the OpenSecureChannel Service call.

SecurityPolicyUri is the securityPolicyUri parameter of the OpenSecureChannel Service call.

SecurityMode is the securityMode parameter of the OpenSecureChannel Service call.

RequestedLifetime is the requestedLifetime parameter of the OpenSecureChannel Service call.

CertificateErrorEventId is the EventId of the corresponding AuditCertificateEventType Event used to report a certificate error.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 29.

Table 29 – AuditSessionEventType definition

Attribute		Value
BrowseName		AuditSessionEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditSecurityEventType defined in 6.4.4, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		SessionId	NodeId	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSecurityEventType. Their semantic is defined in 6.4.4.

If the Event is generated by a TransferSubscriptions Service call, the SourceNode Property shall be assigned to the SessionDiagnostics Object that represents the session. The SourceName for Events of this type shall be "Session/TransferSubscriptions".

Otherwise, the SourceNode Property for Events of this type shall be assigned to the Server Object. The SourceName for Events of this type shall be "Session/" and the Service or cause that generates the Event (e.g. CreateSession, ActivateSession or CloseSession).

The SessionId shall contain the SessionId of the session that the Service call was issued on In the CreateSession Service this shall be set to the newly created SessionId. If no session context exists (e.g. for a failed CreateSession Service call) the SessionId shall be null.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 30.

Table 30 – AuditCreateSessionEventType definition

Attribute		Value
BrowseName		AuditCreateSessionEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditSessionEventType defined in 6.4.7, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		SecureChannelId	String	PropertyType	Mandatory
HasProperty	Variable		ClientCertificate	ByteString	PropertyType	Mandatory
HasProperty	Variable		ClientCertificateThumbprint	String	PropertyType	Mandatory
HasProperty	Variable		RevisedSessionTimeout	Duration	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.7. The SourceName for Events of this type shall be "Session/CreateSession". The ClientUserId is not available for this call thus this parameter shall be set to the "System/CreateSession".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

SecureChannelId shall uniquely identify the SecureChannel. The application shall use the same identifier in all AuditEvents related to the Session Service Set (AuditCreateSessionEventType, AuditActivateSessionEventType and their subtypes) and the SecureChannel Service Set (AuditChannelEventType and its subtypes).

ClientCertificate is the clientCertificate parameter of the CreateSession Service call.

ClientCertificateThumbprint is a thumbprint of the ClientCertificate. See OPC 10000-6 for details on thumbprints.

RevisedSessionTimeout is the returned revisedSessionTimeout parameter of the CreateSession Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 31.

Table 31 – AuditUrlMismatchEventType definition

Attribute		Value
BrowseName		AuditUrlMismatchEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCreateSessionEventType defined in 6.4.8 which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		EndpointUrl	String	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.8.

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

EndpointUrl is the endpointUrl parameter of the CreateSession Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 32.

Table 32 – AuditActivateSessionEventType definition

Attribute		Value
BrowseName		AuditActivateSessionEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditSessionEventType defined in 6.4.7, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		ClientSoftwareCertificates	SignedSoftwareCertificate[]	PropertyType	Mandatory
HasProperty	Variable		UserIdentityToken	UserIdentityToken	PropertyType	Mandatory
HasProperty	Variable		SecureChannelId	String	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.7. The SourceName for Events of this type shall be "Session/ActivateSession".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ClientSoftwareCertificates is the clientSoftwareCertificates parameter of the ActivateSession Service call.

UserIdentityToken reflects the userIdentityToken parameter of the ActivateSession Service call. For Username/Password tokens the password shall not be included.

SecureChannelId shall uniquely identify the SecureChannel. The application shall use the same identifier in all AuditEvents related to the Session Service Set (AuditCreateSessionEventType, AuditActivateSessionEventType and their subtypes) and the SecureChannel Service Set (AuditChannelEventType and its subtypes).

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 33.

Table 33 – AuditCancelEventType definition

Attribute		Value
BrowseName		AuditCancelEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditSessionEventType defined in 6.4.7, i.e. inheriting the InstanceDeclarations of that Node.
HasProperty	Variable		RequestHandle	UInt32	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.7. The SourceName for Events of this type shall be "Session/Cancel".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

RequestHandle is the requestHandle parameter of the Cancel Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 34.

Table 34 – AuditCertificateEventType definition

Attribute		Value
BrowseName		AuditCertificateEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditSecurityEventType defined in 6.4.7, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		Certificate	ByteString	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSecurityEventType. Their semantic is defined in 6.4.4. The SourceName for Events of this type shall be "Security/Certificate".

Certificate is any certificate validated by a Server that encountered a validation issue (i.e. users, applications, etc.). Additional subtypes of this EventType will be defined representing the individual validation errors. This certificate can be matched to the Service that passed it (Session or SecureChannel Service Set) since the AuditEvents for these Services also included the Certificate.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 35.

Table 35 – AuditCertificateDataMismatchEventType definition

Attribute		Value
BrowseName		AuditCertificateDataMismatchEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, i.e. inheriting the InstanceDeclarations of that Node.
HasProperty	Variable		InvalidHostname	String	PropertyType	Mandatory
HasProperty	Variable		InvalidUri	String	PropertyType	Mandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate".

InvalidHostname is the string that represents the host name passed in as part of the URL that is found to be invalid. If the host name was not invalid it can be null.

InvalidUri is the URI that was passed in and found to not match what is contained in the certificate. If the URI was not invalid it can be null.

Either the InvalidHostname or InvalidUri shall be provided.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 36.

Table 36 – AuditCertificateExpiredEventType definition

Attribute		Value
BrowseName		AuditCertificateExpiredEventType
IsAbstract		True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of why the certificate was expired (i.e. time before start or time after end). There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 37.

Table 37 – AuditCertificateInvalidEventType definition

Attribute		Value
BrowseName		AuditCertificateInvalidEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message shall include a description of why the certificate is invalid. There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 38.

Table 38 – AuditCertificateUntrustedEventType definition

Attribute		Value
BrowseName		AuditCertificateUntrustedEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of why the certificate is not trusted. If a trust chain is involved then the certificate that failed in the trust chain should be described. There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 39.

Table 39 – AuditCertificateRevokedEventType definition

Attribute		Value
BrowseName		AuditCertificateRevokedEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of why the certificate is revoked (was the revocation list unavailable or was the certificate on the list). There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 40.

Table 40 – AuditCertificateMismatchEventType definition

Attribute		Value
BrowseName		AuditCertificateMismatchEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of misuse of the certificate. There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 41.

Table 41 – AuditNodeManagementEventType definition

Attribute		Value
BrowseName		AuditNodeManagementEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3. There are no additional Properties defined for this EventType. The SourceNode Property for Events of this type shall be assigned to the Server Object. The SourceName for Events of this type shall be "NodeManagement/" and the Service that generates the Event (e.g. AddNodes, AddReferences, DeleteNodes, DeleteReferences).

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 42.

Table 42 – AuditAddNodesEventType definition

Attribute		Value
BrowseName		AuditAddNodesEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		NodesToAdd	AddNodesItem[]	PropertyType	Mandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/AddNodes".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

NodesToAdd is the NodesToAdd parameter of the AddNodes Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 43.

Table 43 – AuditDeleteNodesEventType definition

Attribute		Value
BrowseName		AuditDeleteNodesEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, i.e. inheriting the InstanceDeclarations of that Node.
HasProperty	Variable		NodesToDelete	DeleteNodesItem[]	PropertyType	Mandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/DeleteNodes".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

NodesToDelete is the nodesToDelete parameter of the DeleteNodes Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 44.

Table 44 – AuditAddReferencesEventType definition

Attribute		Value
BrowseName		AuditAddReferencesEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		ReferencesToAdd	AddReferencesItem[]	PropertyType	Mandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/AddReferences".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ReferencesToAdd is the referencesToAdd parameter of the AddReferences Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 45.

Table 45 – AuditDeleteReferencesEventType definition

Attribute		Value
BrowseName		AuditDeleteReferencesEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		ReferencesToDelete	DeleteReferencesItem[]	PropertyType	Mandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/DeleteReferences".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ReferencesToDelete is the referencesToDelete parameter of the DeleteReferences Service call.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 46.

Table 46 – AuditUpdateEventType definition

Attribute		Value
BrowseName		AuditUpdateEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing History Services
Auditing Write

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3. The SourceNode Property for Events of this type shall be assigned to the NodeId that was changed. The SourceName for Events of this type shall be "Attribute/" and the Service that generated the event (e.g. Write, HistoryUpdate). Note that one Service call may generate several Events of this type, one per changed value.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 47.

Table 47 – AuditWriteUpdateEventType definition

Attribute		Value
BrowseName		AuditWriteUpdateEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditUpdateEventType defined in 6.4.24, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		AttributeId	UInt32	PropertyType	Mandatory
HasProperty	Variable		IndexRange	NumericRange	PropertyType	Mandatory
HasProperty	Variable		NewValue	BaseDataType	PropertyType	Mandatory
HasProperty	Variable		OldValue	BaseDataType	PropertyType	Mandatory
Conformance Units
Auditing Write

This EventType inherits all Properties of the AuditUpdateEventType. The SourceName for Events of this type shall be "Attribute/Write". Their semantic is defined in 6.4.24.

AttributeId identifies the Attribute that was written. The SourceNode Property identifies the Node that was written.

IndexRange identifies the index range of the written Attribute if the Attribute is an array. If the Attribute is not an array or the whole array was written, the IndexRange is set to null.

NewValue identifies the value that was written. If the IndexRange is provided, only the values in the provided range are shown.

OldValue identifies the value that the Attribute contained before the write. If the IndexRange is provided, only the value of that range is shown. It is acceptable for a Server that does not have this information to report a null value.

Both the NewValue and the OldValue will contain a value in the DataType and encoding used for writing the value.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 48.

Table 48 – AuditHistoryUpdateEventType definition

Attribute		Value
BrowseName		AuditHistoryUpdateEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditUpdateEventType defined in 6.4.24, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		ParameterDataTypeId	NodeId	PropertyType	Mandatory
Conformance Units
Auditing History Services

This EventType inherits all Properties of the AuditUpdateEventType. Their semantic is defined in 6.4.24.

The ParameterDataTypeId identifies the DataTypeId for the extensible parameter used by the HistoryUpdate. This parameter indicates the type of HistoryUpdate being performed.

Subtypes of this EventType are defined in OPC 10000-11 representing the different possibilities to manipulate historical data.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 49.

Table 49 – AuditUpdateMethodEventType definition

Attribute		Value
BrowseName		AuditUpdateMethodEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		MethodId	NodeId	PropertyType	Mandatory
HasProperty	Variable		InputArguments	BaseDataType[]	PropertyType	Mandatory
Conformance Units
Auditing Method

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Object that the Method resides on. The SourceName for Events of this type shall be "Attribute/Call". Note that one Service call may generate several Events of this type, one per method called. This EventType should be further subtyped to better reflect the functionality of the method and to reflect changes to the address space or updated values triggered by the method.

MethodId identifies the method that was called.

InputArguments provide the values of the input Arguments passed to the method. This parameter can be null if no input arguments where provided.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 50.

Table 50 – SystemEventType definition

Attribute		Value
BrowseName		SystemEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info Device Failure
Base Info System Status Underlying System
Base Info System Status

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 51.

Table 51 – DeviceFailureEventType definition

Attribute		Value
BrowseName		DeviceFailureEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the SystemEventType defined in 6.4.28, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info Device Failure

This EventType inherits all Properties of the SystemEventType. Their semantic is defined in 6.4.28. There are no additional Properties defined for this EventType.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 52.

Table 52 – SystemStatusChangeEventType definition

Attribute		Value
BrowseName		SystemStatusChangeEventType
IsAbstract		True
References	NodeClass		BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the SystemEventType defined in 6.4.28, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable		SystemState	ServerState	PropertyType	Mandatory
Conformance Units
Base Info System Status Underlying System
Base Info System Status

This EventType inherits all Properties of the SystemEventType. Their semantic is defined in 6.4.28. The SourceNode Property and the SourceName shall identify the system. The system can be the Server itself or some underlying system.

The SystemState specifies the current state of the system. Changes to the ServerState of the system shall trigger a SystemStatusChangeEvent, when the event is supported by the system.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 53.

Table 53 – BaseModelChangeEventType definition

Attribute	Value
BrowseName	BaseModelChangeEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info Model Change

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. There are no additional Properties defined for this EventType. The SourceNode Property for Events of this type shall be the Node of the View that gives the context of the changes. If the whole AddressSpace is the context, the SourceNode Property is set to the NodeId of the Server Object. The SourceName for Events of this type shall be the String part of the BrowseName of the View; for the whole AddressSpace it shall be "Server".

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 54.

Table 54 – GeneralModelChangeEventType definition

Attribute	Value
BrowseName	GeneralModelChangeEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseModelChangeEventType defined in 6.4.31, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable	Changes	ModelChangeStructureDataType[]	PropertyType	Mandatory
Conformance Units
Base Info Model Change General

This EventType inherits all Properties of the BaseModelChangeEventType. Their semantic is defined in 6.4.31.

The additional Property defined for this EventType reflects the changes that issued the ModelChangeEvent. It shall contain at least one entry in its array. Its structure is defined in 12.16.

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 55.

Table 55 – SemanticChangeEventType definition

Attribute	Value
BrowseName	SemanticChangeEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable	Changes	SemanticChangeStructureDataType[]	PropertyType	Mandatory
Conformance Units
Base Info SemanticChange

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. The SourceNode Property for Events of this type shall be the Node of the View that gives the context of the changes. If the whole AddressSpace is the context, the SourceNode Property is set to the NodeId of the Server Object. The SourceName for Events of this type shall be the String part of the BrowseName of the View, for the whole AddressSpace it shall be "Server".

The additional Property defined for this EventType reflects the changes that issued the SemanticChangeEvent. Its structure is defined in 12.17.

EventQueueOverflow Events are generated when an internal queue of a MonitoredItem subscribing for Events in the Server overflows. OPC 10000-4 defines when the internal EventQueueOverflow Events shall be generated.

The EventType for EventQueueOverflow Events is formally defined in Table 56.

Table 56 – EventQueueOverflowEventType definition

Attribute	Value
BrowseName	EventQueueOverflowEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info EventQueueOverflow EventType

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Server Object. The SourceName for Events of this type shall be "Internal/EventQueueOverflow".

ProgressEvents are generated to identify the progress of an operation. An operation can be a Service call or something application specific like a program execution.

The EventType for Progress Events is formally defined in Table 57.

Table 57 – ProgressEventType definition

Attribute	Value
BrowseName	ProgressEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable	Context	BaseDataType	PropertyType	Mandatory
HasProperty	Variable	Progress	UInt16	PropertyType	Mandatory
Conformance Units
Base Info Progress Events

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Session Object where the operation was initiated. The SourceName for Events of this type shall be "Service/<Service Name as defined in OPC 10000-4>" when the progress of a Service call is exposed.

The additional Property Context contains context information about what operation progress is reported. In the case of Service calls it shall be a UInt32 containing the requestHandle of the RequestHeader of the Service call.

The additional Property Progress contains the percentage completed of the progress. The value shall be between 0 and 100, where 100 identifies that the operation has been finished.

It is recommended that Servers only expose ProgressEvents for Service calls to the Session that invoked the Service.

This EventType is used for the categorization of Events generated by a Client. Its representation in the AddressSpace is formally defined in Table 58.

Table 58 – AuditClientEventType definition

Attribute	Value
BrowseName	AuditClientEventType
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable	ServerUri	UriString	PropertyType	Mandatory
ConformanceUnits
Base Info Client Events

This class of Audit Events are generated by Servers that also support Client functionality. They represent the Client actions taken by the Server.

This EventType inherits all Properties of the AuditEventType. Their semantics are defined in 6.4.3. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Object that is related to the action. If no Object is related, then the SourceNode Property shall be the NodeId of the Server Object.

ServerUri provides the URI of the Server that the Client was accessing.

This EventType allows Method calls issued by a Client to be audited. Its representation in the AddressSpace is formally defined in Table 59.

Table 59 – AuditClientUpdateMethodResultEventType definition

Attribute	Value
BrowseName	AuditClientUpdateMethodResultEventType
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
Subtype of the AuditClientEventType defined in 6.4.36, which means it inherits the InstanceDeclarations of that Node.
HasProperty	Variable	ObjectId	NodeId	PropertyType	Mandatory
HasProperty	Variable	MethodId	NodeId	PropertyType	Mandatory
HasProperty	Variable	StatusCodeId	StatusCode	PropertyType	Mandatory
HasProperty	Variable	InputArguments	BaseDataType[]	PropertyType	Mandatory
HasProperty	Variable	OutputArguments	BaseDataType[]	PropertyType	Mandatory
ConformanceUnits
Base Info Client Events

This EventType inherits all Properties of the AuditClientEventType. Their semantics are defined in 6.4.36. The SourceName for Events of this type shall be "Client/Call". A single Client action may generate several Events of this type, one per Method called.

ObjectId identifies the Object on which the Method was called. The Object may be located on the same Server as the calling instance or on a remote Server.

MethodId identifies the method that was called.

StatusCodeId identifies the overall status returned by the Method Call.

InputArguments identifies the input Arguments for the method. This parameter can be null if no input arguments were provided.

OutputArguments identifies the output Arguments of the method. This parameter can be null if no output arguments where provided.