5.8 Historical Audit Events

5.8.1 General

AuditEvents are generated as a result of an action taken on the Server by a Client of the Server. For example, in response to a Client issuing a write to a Variable, the Server would generate an AuditEvent describing the Variable as the source and the user and Client Session as the initiators of the Event. Not all Servers support auditing, but if a Server supports auditing, then it shall support audit Events as described in OPC 10000-7 to determine if a Server supports auditing. Servers shall generate Events of the AuditHistoryUpdateEventType or a sub-type of this type for all invocations of the HistoryUpdate Service on any HistoricalNode. See OPC 10000-3 and OPC 10000-5 for details on the AuditHistoryUpdateEventType model. In the case where the HistoryUpdate Service is invoked to insert Historical Events, the AuditHistoryEventUpdateEventType Event shall include the EventId of the inserted Event and a description that indicates that the Event was inserted. In the case where the HistoryUpdate Service is invoked to delete records, the AuditHistoryDeleteEventType or one of its sub-types shall be generated. See 6.8 for details on updating historical data or Events.

In particular using the Delete raw or Delete modified functionality shall generate an AuditHistoryRawModifyDeleteEventType Event or a sub-type of it. Using the Delete at time functionality shall generate an AuditHistoryAtTimeDeleteEventType Event or a sub-type of it. Using the Delete Event functionality shall generate an AuditHistoryEventDeleteEventType Event or a sub-type of it. All other updates shall follow the guidelines provided in the AuditHistoryUpdateEventType model.

5.8.2 AuditHistoryEventUpdateEventType

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of History Event update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 16.

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdateNode identifies the Attribute that was written on the SourceNode.

The PerformInsertReplace enumeration reflects the parameter on the Service call.

The Filter reflects the Event filter passed on the call to select the Events that are to be updated.

The NewValues identify the value that was written to the Event.

The OldValues identify the value that the Events contained before the update. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain Events with the appropriate fields, each with appropriately encoded values.

5.8.3 AuditHistoryValueUpdateEventType

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of history value update related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 17.

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdatedNode identifies the Attribute that was written on the SourceNode.

The PerformInsertReplace enumeration reflects the parameter on the Service call.

The NewValues identify the value that was written to the Event.

The OldValues identify the value that the Event contained before the write. It is acceptable for a Server that does not have this information to report a null value. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain a value in the DataType and encoding used for writing the value.

5.8.4 AuditHistoryAnnotationUpdateEventType

This is a subtype of AuditHistoryUpdateEventType and is used the insertion or change of an annotation. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 18.

This EventType inherits all Properties of the AuditHistoryUpdateEventType. Their semantic is defined in OPC 10000-3.

The PerformInsertReplace enumeration reflects the corresponding parameter on the Service call.

The NewValues identify the Annotation that was written. In the case of a remove, it is expected to be a null value.

The OldValues identify the value that the Annotation contained before the write. It is acceptable for a Server that does not have this information to report a null value in the case of an update. In the case of an insert it is expected to be a null value.

Both the NewValues and the OldValues will contain a value in the DataType and encoding used for writing the value.

5.8.5 AuditHistoryDeleteEventType

This is a subtype of AuditHistoryUpdateEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 19.

This EventType inherits all Properties of the AuditUpdateEventType. Their semantic is defined in OPC 10000-3.

The UpdatedNode property identifies the NodeId that was used for the delete operation.

5.8.6 AuditHistoryRawModifyDeleteEventType

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 20.

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.8.5.

The IsDeleteModified reflects the isDeleteModified parameter of the call.

The StartTime reflects the starting time parameter of the call.

The EndTime reflects the ending time parameter of the call.

The OldValues identify the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain a value in the DataType and encoding used for writing the value.

5.8.7 AuditHistoryAtTimeDeleteEventType

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 21.

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.8.8.

The ReqTimes reflect the request time parameter of the call.

The OldValues identifies the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain a value in the DataType and encoding used for writing the value.

5.8.8 AuditHistoryEventDeleteEventType

This is a subtype of AuditHistoryDeleteEventType and is used for categorization of history delete related Events. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 22.

This EventType inherits all Properties of the AuditHistoryDeleteEventType. Their semantic is defined in 5.8.5.

The EventIds reflect the EventIds parameter of the call.

The OldValues identify the value that history contained before the delete. A Server should report all deleted values. It is acceptable for a Server that does not have this information to report a null value. The OldValues will contain an Event with the appropriate fields, each with appropriately encoded values.

5.8.9 AuditHistoryConfigurationChangeEventType

This is a subtype of AuditEventType and is used for categorization of history configuration changes. This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined in Table 22.

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in OPC 10000-5.

5.8.10 AuditHistoryBulkInsertEventType

This is a subtype of AuditEventType and is used for tracking a bulk insertion of HistoricalData or HistoricalEvents into a Historian. This Event should not be generated for a given Node more frequently than once per minute, even if inserts occur more frequently.

This type follows all the behaviour of its parent type. Its representation in the AddressSpace is formally defined Table 24.

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in OPC 10000-5.

UpdatedNode is the NodeId that had a bulk insert of historical information. It can be a HistoricalDataNode or a HistoricalEventNode.

StartTime is the oldest time of the block that was inserted.

EndTime is the newest time of the block that was inserted.