6.4 ObjectTypes used as EventTypes

6.4.1 General

This document defines standard EventTypes. They are represented in the AddressSpace as ObjectTypes. The EventTypes are already defined in OPC 10000-3. The following subclauses specify their representation in the AddressSpace.

6.4.2 BaseEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 25.

Table 25 – BaseEventType definition
Attribute Value
BrowseNameBaseEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition Modelling
Rule
Subtype of the BaseObjectType defined in 6.2
HasPropertyVariableEventIdByteStringPropertyTypeMandatory
HasPropertyVariableEventTypeNodeIdPropertyTypeMandatory
HasPropertyVariableSourceNodeNodeIdPropertyTypeMandatory
HasPropertyVariableSourceNameStringPropertyTypeMandatory
HasPropertyVariableTimeUtcTimePropertyTypeMandatory
HasPropertyVariableReceiveTimeUtcTimePropertyTypeMandatory
HasPropertyVariableLocalTimeTimeZoneDataTypePropertyTypeOptional
HasPropertyVariableMessageLocalizedTextPropertyTypeMandatory
HasPropertyVariableSeverityUInt16PropertyTypeMandatory
HasPropertyVariableConditionClassIdNodeIdPropertyTypeOptional
HasPropertyVariableConditionClassNameLocalizedTextPropertyTypeOptional
HasPropertyVariableConditionSubClassIdNodeId[]PropertyTypeOptional
HasPropertyVariableConditionSubClassNameLocalizedText[]PropertyTypeOptional
Conformance Units
Address Space Events

EventId is generated by the Server to uniquely identify a particular Event Notification. The Server is responsible to ensure that each Event has its unique EventId. It may do this, for example, by putting GUIDs into the ByteString. Clients can use the EventId to assist in minimizing or eliminating gaps and overlaps that may occur during a redundancy failover. The EventId shall always be returned as value and the Server is not allowed to return a StatusCode for the EventId indicating an error.

EventType describes the specific type of Event. The EventType shall always be returned as value and the Server is not allowed to return a StatusCode for the EventType indicating an error.

The SourceNode Property identifies the Node that the Event originated from. If the Event is not specific to a Node the NodeId is set to null. Some subtypes of this BaseEventType may define additional rules for the SourceNode Property.

SourceName provides a description of the source of the Event. This could be the string-part of the DisplayName of the Event source using the default locale of the server, if the Event is specific to a Node, or some server-specific notation.

Time provides the time the Event occurred. This value is set as close to the event generator as possible. It often comes from the underlying system or device. Once set, intermediate OPC UA Servers shall not alter the value.

ReceiveTime provides the time the OPC UA Server received the Event from the underlying device of another Server. ReceiveTime is analogous to ServerTimestamp defined in OPC 10000-4, i.e. in the case where the OPC UA Server gets an Event from another OPC UA Server, each Server applies its own ReceiveTime. That implies that a Client may get the same Event, having the same EventId, from different Servers having different values of the ReceiveTime. The ReceiveTime shall always be returned as value and the Server is not allowed to return a StatusCode for the ReceiveTime indicating an error.

LocalTime is a structure containing the Offset and the DaylightSavingInOffset flag. The Offset specifies the time difference (in minutes) between the Time Property and the time at the location in which the event was issued. If DaylightSavingInOffset is TRUE, then Standard/Daylight savings time (DST) at the originating location is in effect and Offset includes the DST correction. If FALSE then the Offset does not include DST correction and DST may or may not have been in effect.

Message provides a human-readable and localizable text description of the Event. The Server may return any appropriate text to describe the Event. A null string is not a valid value; if the Server does not have a description, it shall return the string part of the BrowseName of the Node associated with the Event.

Severity is an indication of the urgency of the Event. This is also commonly called "priority". Values will range from 1 to 1 000, with 1 being the lowest severity and 1 000 being the highest. Typically, a severity of 1 would indicate an Event which is informational in nature, while a value of 1 000 would indicate an Event of catastrophic nature, which could potentially result in severe financial loss or loss of life.

It is expected that very few Server implementations will support 1 000 distinct severity levels. Therefore, Server developers are responsible for distributing their severity levels across the 1 to 1 000 range in such a manner that clients can assume a linear distribution. For example, a client wishing to present five severity levels to a user should be able to do the following mapping:

Client SeverityOPC Severity
HIGH801 to 1 000
MEDIUM HIGH601 to 800
MEDIUM401 to 600
MEDIUM LOW201 to 400
LOW1 to 200

In many cases a strict linear mapping of underlying source severities to the OPC Severity range is not appropriate. The Server developer will instead intelligently map the underlying source severities to the 1 to 1 000 OPC Severity range in some other fashion. In particular, it is recommended that Server developers map Events of high urgency into the OPC severity range of 667 to 1 000, Events of medium urgency into the OPC severity range of 334 to 666 and Events of low urgency into OPC severities of 1 to 333.

For example, if a source supports 16 severity levels that are clustered such that severities 0 to 2 are considered to be LOW, 3 to 7 are MEDIUM and 8 to 15 are HIGH, then an appropriate mapping might be as follows:

OPC RangeSource SeverityOPC Severity
HIGH (667 to 1 000)151 000
14955
13910
12865
11820
10775
9730
8685
MEDIUM (334 to 666)7650
6575
5500
4425
3350
LOW (1 to 333)2300
1150
01

Some Servers might not support any Events which are catastrophic in nature, so they may choose to map all of their severities into a subset of the 1 to 1 000 range (for example, 1 to 666). Other Servers might not support any Events which are merely informational, so they may choose to map all of their severities into a different subset of the 1 to 1 000 range (for example, 334 to 1 000).

The purpose of this approach is to allow clients to use severity values from multiple Servers from different vendors in a consistent manner. Additional discussions of severity can be found in OPC 10000-9.

ConditionClassId specifies in which domain this Event is used. It is the NodeId of the corresponding subtype of BaseConditionClassType. See OPC 10000-9 for the definition of ConditionClass and a set of ConditionClasses defined in this standard. When using this Property for filtering, Clients have to specify all individual subtypes of BaseConditionClassType NodeIds. The OfType operator cannot be applied. BaseConditionClassType is used as class whenever an Event cannot be assigned to a more concrete class.

ConditionClassName provides the DisplayName of the of the ConditionClassType provided in the ConditionClassId.

ConditionSubClassId specifies additional class[es] that apply to the Event. It is the NodeId of the corresponding subtype of BaseConditionClassType. See OPC 10000-9 for the definition of ConditionClass and a set of ConditionClasses defined in this standard. When using this Property for filtering, Clients have to specify all individual sub types of BaseConditionClassType NodeIds. The OfType operator cannot be applied. The Client specifies a NULL in the filter, to return Events where no sub class is applied. When returning Events, if this optional field is not available in an Event, a NULL shall be returned for the field.

ConditionSubClassName provides the DisplayName[s] of the ConditionClassType[s] listed in the ConditionSubClassId.

The BrowseNames of the ConditionClassId, ConditionClassName, ConditionSubClassId, and ConditionSubClassName Properties originated from OPC 10000-9. They have now been generalized to also apply to Events, however to preserve backward compatibility the names have been preserved.

6.4.3 AuditEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 26.

Table 26 – AuditEventType definition
Attribute Value
BrowseNameAuditEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition Modelling
Rule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableActionTimeStampUtcTimePropertyTypeMandatory
HasPropertyVariableStatusBooleanPropertyTypeMandatory
HasPropertyVariableServerIdStringPropertyTypeMandatory
HasPropertyVariableClientAuditEntryIdStringPropertyTypeMandatory
HasPropertyVariableClientUserIdStringPropertyTypeMandatory
HasPropertyVariableClientApplicationUriStringPropertyTypeOptional
Conformance Units
Auditing Connections
Auditing NodeManagement
Auditing History Services
Auditing Write
Auditing Method

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2.

The BaseEventType Properties are used to describe the source of the AuditEvent. SubTypes of AuditEventType may define the Node to assign to the SourceNode Property, if not defined the SourceNode Property shall be set to the Server Node. The SourceName Property for AuditEvent typically provides more information related to the source of the AuditEvents. If the AuditEvent is related to a Method invocation, then typically this Property would be “Method/” concatenated with the name of the invoked Method.

Subtypes of AuditEventType are defined so that the EventTypeId can be used to sort and categorize AuditEvents. It is recommended that new subtypes of AuditEventType do not add additional Properties beyond what is defined in the core UA specifications. This allows a generic audit Client to collect all relevant information using an EventFilter consisting of Event fields from the core AuditEventTypes.

ActionTimeStamp identifies the time the user initiated the action that resulted in the AuditEvent being generated. It differs from the Time Property because this is the time the server generated the AuditEvent documenting the action.

Status identifies whether the requested action could be performed (set Status to TRUE) or not (set Status to FALSE).

ServerId uniquely identifies the Server generating the Event. It identifies the Server uniquely even in a server-controlled transparent redundancy scenario where several Servers may use the same URI.

ClientAuditEntryId contains the human-readable AuditEntryId defined in OPC 10000-4. If the Server is unable to decrypt AuditEntryId due to a certificate check failure, then some Client identification should be used such as the Client’s IP Address, port, MAC address and/or DNS name as the ClientAuditEntryId.

The ClientUserId identifies the user of the client requesting an action. The ClientUserId can be obtained from the UserIdentityToken passed in the ActivateSession call. If the UserIdentityToken is a UserNameIdentityToken then the ClientUserId shall be the UserName. If the UserIdentityToken is an X509IdentityToken then the ClientUserId shall be the X509 Subject Name of the Certificate. If the UserIdentityToken is an IssuedIdentityToken then the ClientUserId shall be a string that represents the owner of the token. The best choice for the string depends on the type of IssuedIdentityToken. If the UserIdentityToken is a JWT IssuedIdentityToken, then the ClientUserId shall depend on the existence of the ‘iss’ (issuer) field of the JWT IssuedIdentityToken. If the ‘iss’ field is present the ClientUserId shall be the value of the ‘iss’ field of the JWT IssuedIdentityToken concatenated with the value of the ‘sub’ field of the JWT IssuedIdentityToken. If the ‘iss’ field of the JWT IssuedIdentityToken is not present, the ClientUserId shall be the value of the ‘sub’ field of the JWT IssuedIdentityToken. If an AnonymousIdentityToken is being used, the ClientUserId shall be null.

The ClientApplicationUri identifies the application requesting the action. If the action is initiated by a Client, then the ClientApplicationUri shall be the applicationUri from the ClientDescription (ApplicationDescriptionType).

6.4.4 AuditSecurityEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 27.

Table 27 – AuditSecurityEventType definition
Attribute Value
BrowseNameAuditSecurityEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableStatusCodeIdStatusCodePropertyTypeOptional
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3.

The optional StatusCodeId Property provides the exact security error responsible for producing the Event.

6.4.5 AuditChannelEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 28.

Table 28 – AuditChannelEventType definition
Attribute Value
BrowseNameAuditChannelEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition Modelling
Rule
Subtype of the AuditSecurityEventType defined in 6.4.4, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableSecureChannelIdStringPropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSecurityEventType. Their semantic is defined in 6.4.4. The SourceNode Property for Events of this type shall be assigned to the Server Object. The SourceName for Events of this type shall be "SecureChannel/" and the Service that generates the Event (e.g. SecureChannel/OpenSecureChannel or SecureChannel/CloseSecureChannel). If the ClientUserId is not available for a CloseSecureChannel call, then this parameter shall be set to "System/CloseSecureChannel".

The SecureChannelId shall uniquely identify the SecureChannel. The application shall use the same identifier in all AuditEvents related to the Session Service Set (AuditCreateSessionEventType, AuditActivateSessionEventType and their subtypes) and the SecureChannel Service Set (AuditChannelEventType and its subtypes).

6.4.6 AuditOpenSecureChannelEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 29.

Table 29 – AuditOpenSecureChannelEventType definition
Attribute Value
BrowseNameAuditOpenSecureChannelEventType
IsAbstractTrue
References Node
Class
BrowseName DataType TypeDefinition Modelling
Rule
Subtype of the AuditChannelEventType defined in 6.4.5, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableClientCertificateByteStringPropertyTypeMandatory
HasPropertyVariableClientCertificateThumbprintStringPropertyTypeMandatory
HasPropertyVariableRequestTypeSecurityTokenRequestTypePropertyTypeMandatory
HasPropertyVariableSecurityPolicyUriStringPropertyTypeMandatory
HasPropertyVariableSecurityModeMessageSecurityModePropertyTypeMandatory
HasPropertyVariableRequestedLifetimeDurationPropertyTypeMandatory
HasPropertyVariableCertificateErrorEventIdByteStringPropertyTypeOptional
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditChannelEventType. Their semantic is defined in 6.4.5. The SourceName for Events of this type shall be "SecureChannel/OpenSecureChannel". The ClientUserId is not available for this call, thus this parameter shall be set to "System/OpenSecureChannel".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ClientCertificate is the clientCertificate parameter of the OpenSecureChannel Service call.

ClientCertificateThumbprint is a thumbprint of the ClientCertificate. See OPC 10000-6 for details on thumbprints.

RequestType is the requestType parameter of the OpenSecureChannel Service call.

SecurityPolicyUri is the securityPolicyUri parameter of the OpenSecureChannel Service call.

SecurityMode is the securityMode parameter of the OpenSecureChannel Service call.

RequestedLifetime is the requestedLifetime parameter of the OpenSecureChannel Service call.

CertificateErrorEventId is the EventId of the corresponding AuditCertificateEventType Event used to report a certificate error.

6.4.7 AuditSessionEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 30.

Table 30 – AuditSessionEventType definition
Attribute Value
BrowseNameAuditSessionEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditSecurityEventType defined in 6.4.4, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableSessionIdNodeIdPropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSecurityEventType. Their semantic is defined in 6.4.4.

If the Event is generated by a TransferSubscriptions Service call, the SourceNode Property shall be assigned to the SessionDiagnostics Object that represents the session. The SourceName for Events of this type shall be "Session/TransferSubscriptions".

Otherwise, the SourceNode Property for Events of this type shall be assigned to the Server Object. The SourceName for Events of this type shall be "Session/" and the Service or cause that generates the Event (e.g. CreateSession, ActivateSession or CloseSession).

The SessionId shall contain the SessionId of the session that the Service call was issued on In the CreateSession Service this shall be set to the newly created SessionId. If no session context exists (e.g. for a failed CreateSession Service call) the SessionId shall be null.

6.4.8 AuditCreateSessionEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 31.

Table 31 – AuditCreateSessionEventType definition
Attribute Value
BrowseNameAuditCreateSessionEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditSessionEventType defined in 6.4.7, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableSecureChannelIdStringPropertyTypeMandatory
HasPropertyVariableClientCertificateByteStringPropertyTypeMandatory
HasPropertyVariableClientCertificateThumbprintStringPropertyTypeMandatory
HasPropertyVariableRevisedSessionTimeoutDurationPropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.7. The SourceName for Events of this type shall be "Session/CreateSession". The ClientUserId is not available for this call thus this parameter shall be set to the "System/CreateSession".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

SecureChannelId shall uniquely identify the SecureChannel. The application shall use the same identifier in all AuditEvents related to the Session Service Set (AuditCreateSessionEventType, AuditActivateSessionEventType and their subtypes) and the SecureChannel Service Set (AuditChannelEventType and its subtypes).

ClientCertificate is the clientCertificate parameter of the CreateSession Service call.

ClientCertificateThumbprint is a thumbprint of the ClientCertificate. See OPC 10000-6 for details on thumbprints.

RevisedSessionTimeout is the returned revisedSessionTimeout parameter of the CreateSession Service call.

6.4.9 AuditUrlMismatchEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 32. This Type has been deprecated and will be removed in a future version.

Table 32 – AuditUrlMismatchEventType definition
Attribute Value
BrowseNameAuditUrlMismatchEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCreateSessionEventType defined in 6.4.8 which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableEndpointUrlStringPropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.8.

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

EndpointUrl is the endpointUrl parameter of the CreateSession Service call.

6.4.10 AuditActivateSessionEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 33.

Table 33 – AuditActivateSessionEventType definition
Attribute Value
BrowseNameAuditActivateSessionEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition Modelling
Rule
Subtype of the AuditSessionEventType defined in 6.4.7, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableClientSoftwareCertificatesSignedSoftwareCertificate[]PropertyTypeMandatory
HasPropertyVariableUserIdentityTokenUserIdentityTokenPropertyTypeMandatory
HasPropertyVariableSecureChannelIdStringPropertyTypeMandatory
HasPropertyVariableCurrentRoleIdsNodeId[]PropertyTypeOptional
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.7. The SourceName for Events of this type shall be "Session/ActivateSession".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ClientSoftwareCertificates is the clientSoftwareCertificates parameter of the ActivateSession Service call.

UserIdentityToken reflects the userIdentityToken parameter of the ActivateSession Service call. For Username/Password tokens the password shall not be included.

SecureChannelId shall uniquely identify the SecureChannel. The application shall use the same identifier in all AuditEvents related to the Session Service Set (AuditCreateSessionEventType, AuditActivateSessionEventType and their subtypes) and the SecureChannel Service Set (AuditChannelEventType and its subtypes).

CurrentRoleIds is an optional array providing the NodeId of each Role the Server has granted to the activated Session.

The additional definition for the conformance units of AuditActivateSessionEventType are defined in Table 35.

Table 34 – AuditActivateSessionEventType Additional Conformance Units
BrowsePath Conformance Units
CurrentRoleIdsSecurity Role Server Base 2

6.4.11 AuditCancelEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 35.

Table 35 – AuditCancelEventType definition
Attribute Value
BrowseNameAuditCancelEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditSessionEventType defined in 6.4.7, i.e. inheriting the InstanceDeclarations of that Node.
HasPropertyVariableRequestHandleUInt32PropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSessionEventType. Their semantic is defined in 6.4.7. The SourceName for Events of this type shall be "Session/Cancel".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

RequestHandle is the requestHandle parameter of the Cancel Service call.

6.4.12 AuditCertificateEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 36.

Table 36 – AuditCertificateEventType definition
Attribute Value
BrowseNameAuditCertificateEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition Modelling
Rule
Subtype of the AuditSecurityEventType defined in 6.4.7, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableCertificateByteStringPropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditSecurityEventType. Their semantic is defined in 6.4.4. The SourceName for Events of this type shall be "Security/Certificate".

Certificate is any certificate validated by a Server that encountered a validation issue (i.e. users, applications, etc.). Additional subtypes of this EventType will be defined representing the individual validation errors. This certificate can be matched to the Service that passed it (Session or SecureChannel Service Set) since the AuditEvents for these Services also included the Certificate.

6.4.13 AuditCertificateDataMismatchEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 37.

Table 37 – AuditCertificateDataMismatchEventType definition
Attribute Value
BrowseNameAuditCertificateDataMismatchEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, i.e. inheriting the InstanceDeclarations of that Node.
HasPropertyVariableInvalidHostnameStringPropertyTypeMandatory
HasPropertyVariableInvalidUriStringPropertyTypeMandatory
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate".

InvalidHostname is the string that represents the host name passed in as part of the URL that is found to be invalid. If the host name was not invalid it can be null.

InvalidUri is the URI that was passed in and found to not match what is contained in the certificate. If the URI was not invalid it can be null.

Either the InvalidHostname or InvalidUri shall be provided.

6.4.14 AuditCertificateExpiredEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 38.

Table 38 – AuditCertificateExpiredEventType definition
Attribute Value
BrowseNameAuditCertificateExpiredEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of why the certificate was expired (i.e. time before start or time after end). There are no additional Properties defined for this EventType.

6.4.15 AuditCertificateInvalidEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 39.

Table 39 – AuditCertificateInvalidEventType definition
Attribute Value
BrowseNameAuditCertificateInvalidEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message shall include a description of why the certificate is invalid. There are no additional Properties defined for this EventType.

6.4.16 AuditCertificateUntrustedEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 40.

Table 40 – AuditCertificateUntrustedEventType definition
Attribute Value
BrowseNameAuditCertificateUntrustedEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of why the certificate is not trusted. If a trust chain is involved then the certificate that failed in the trust chain should be described. There are no additional Properties defined for this EventType.

6.4.17 AuditCertificateRevokedEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 41.

Table 41 – AuditCertificateRevokedEventType definition
Attribute Value
BrowseNameAuditCertificateRevokedEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of why the certificate is revoked (was the revocation list unavailable or was the certificate on the list). There are no additional Properties defined for this EventType.

6.4.18 AuditCertificateMismatchEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 42.

Table 42 – AuditCertificateMismatchEventType definition
Attribute Value
BrowseNameAuditCertificateMismatchEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditCertificateEventType defined in 6.4.12, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing Connections

This EventType inherits all Properties of the AuditCertificateEventType. Their semantic is defined in 6.4.12. The SourceName for Events of this type shall be "Security/Certificate". The Message Variable shall include a description of misuse of the certificate. There are no additional Properties defined for this EventType.

6.4.19 AuditNodeManagementEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 43.

Table 43 – AuditNodeManagementEventType definition
Attribute Value
BrowseNameAuditNodeManagementEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3. There are no additional Properties defined for this EventType. The SourceNode Property for Events of this type shall be assigned to the Server Object. The SourceName for Events of this type shall be "NodeManagement/" and the Service that generates the Event (e.g. AddNodes, AddReferences, DeleteNodes, DeleteReferences).

6.4.20 AuditAddNodesEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 44.

Table 44 – AuditAddNodesEventType definition
Attribute Value
BrowseNameAuditAddNodesEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableNodesToAddAddNodesItem[]PropertyTypeMandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/AddNodes".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

NodesToAdd is the NodesToAdd parameter of the AddNodes Service call.

6.4.21 AuditDeleteNodesEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 45.

Table 45 – AuditDeleteNodesEventType definition
Attribute Value
BrowseNameAuditDeleteNodesEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, i.e. inheriting the InstanceDeclarations of that Node.
HasPropertyVariableNodesToDeleteDeleteNodesItem[]PropertyTypeMandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/DeleteNodes".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

NodesToDelete is the nodesToDelete parameter of the DeleteNodes Service call.

6.4.22 AuditAddReferencesEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 46.

Table 46 – AuditAddReferencesEventType definition
Attribute Value
BrowseNameAuditAddReferencesEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableReferencesToAddAddReferencesItem[]PropertyTypeMandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/AddReferences".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ReferencesToAdd is the referencesToAdd parameter of the AddReferences Service call.

6.4.23 AuditDeleteReferencesEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 47.

Table 47 – AuditDeleteReferencesEventType definition
Attribute Value
BrowseNameAuditDeleteReferencesEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditNodeManagementEventType defined in 6.4.19, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableReferencesToDeleteDeleteReferencesItem[]PropertyTypeMandatory
Conformance Units
Auditing NodeManagement

This EventType inherits all Properties of the AuditNodeManagementEventType. Their semantic is defined in 6.4.19. The SourceName for Events of this type shall be "NodeManagement/DeleteReferences".

The additional Properties defined for this EventType reflect parameters of the Service call that triggers the Event.

ReferencesToDelete is the referencesToDelete parameter of the DeleteReferences Service call.

6.4.24 AuditUpdateEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 48.

Table 48 – AuditUpdateEventType definition
Attribute Value
BrowseNameAuditUpdateEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Auditing History Services
Auditing Write

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3. The SourceNode Property for Events of this type shall be assigned to the NodeId that was changed. The SourceName for Events of this type shall be "Attribute/" and the Service that generated the event (e.g. Write, HistoryUpdate). Note that one Service call may generate several Events of this type, one per changed value.

6.4.25 AuditWriteUpdateEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 49.

Table 49 – AuditWriteUpdateEventType definition
Attribute Value
BrowseNameAuditWriteUpdateEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditUpdateEventType defined in 6.4.24, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableAttributeIdUInt32PropertyTypeMandatory
HasPropertyVariableIndexRangeNumericRangePropertyTypeMandatory
HasPropertyVariableNewValueBaseDataTypePropertyTypeMandatory
HasPropertyVariableOldValueBaseDataTypePropertyTypeMandatory
Conformance Units
Auditing Write

This EventType inherits all Properties of the AuditUpdateEventType. The SourceName for Events of this type shall be "Attribute/Write". Their semantic is defined in 6.4.24.

AttributeId identifies the Attribute that was written. The SourceNode Property identifies the Node that was written.

IndexRange identifies the index range of the written Attribute if the Attribute is an array. If the Attribute is not an array or the whole array was written, the IndexRange is set to null.

NewValue identifies the value that was written. If the IndexRange is provided, only the values in the provided range are shown.

OldValue identifies the value that the Attribute contained before the write. If the IndexRange is provided, only the value of that range is shown. It is acceptable for a Server that does not have this information to report a null value.

Both the NewValue and the OldValue will contain a value in the DataType and encoding used for writing the value.

6.4.26 AuditHistoryUpdateEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 50.

Table 50 – AuditHistoryUpdateEventType definition
Attribute Value
BrowseNameAuditHistoryUpdateEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditUpdateEventType defined in 6.4.24, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableParameterDataTypeIdNodeIdPropertyTypeMandatory
Conformance Units
Auditing History Services

This EventType inherits all Properties of the AuditUpdateEventType. Their semantic is defined in 6.4.24.

The ParameterDataTypeId identifies the DataTypeId for the extensible parameter used by the HistoryUpdate. This parameter indicates the type of HistoryUpdate being performed.

Subtypes of this EventType are defined in OPC 10000-11 representing the different possibilities to manipulate historical data.

6.4.27 AuditUpdateMethodEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 51.

Table 51 – AuditUpdateMethodEventType definition
Attribute Value
BrowseNameAuditUpdateMethodEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableMethodIdNodeIdPropertyTypeMandatory
HasPropertyVariableStatusCodeIdStatusCodePropertyTypeOptional
HasPropertyVariableInputArgumentsBaseDataType[]PropertyTypeMandatory
HasPropertyVariableOutputArgumentsBaseDataType[]PropertyTypeOptional
Conformance Units
Auditing Method
Auditing Method Output

This EventType inherits all Properties of the AuditEventType. Their semantic is defined in 6.4.3. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Object that the Method resides on. The SourceName for Events of this type shall be "Attribute/Call". Note that one Service call may generate several Events of this type, one per method called. This EventType should be further subtyped to better reflect the functionality of the method and to reflect changes to the address space or updated values triggered by the method.

MethodId identifies the method that was called.

StatusCodeId identifies the StatusCode of the Method executed by the Server.

Note: This Property is optional for backward compatibility and required by Profiles starting with version 1.05.

InputArguments provide the values of the input arguments passed to the Method. This parameter can be null if no input arguments were provided.

OutputArguments provide the values of the output arguments returned by the Method. This parameter can be null if no output arguments were returned.

Note: This Property is optional for backward compatibility and required by Profiles starting with version 1.05.

6.4.28 SystemEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 52.

Table 52 – SystemEventType definition
Attribute Value
BrowseNameSystemEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info Device Failure
Base Info System Status Underlying System
Base Info System Status

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. There are no additional Properties defined for this EventType.

6.4.29 DeviceFailureEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 53.

Table 53 – DeviceFailureEventType definition
Attribute Value
BrowseNameDeviceFailureEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the SystemEventType defined in 6.4.28, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info Device Failure

This EventType inherits all Properties of the SystemEventType. Their semantic is defined in 6.4.28. There are no additional Properties defined for this EventType.

6.4.30 SystemStatusChangeEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 54.

Table 54 – SystemStatusChangeEventType definition
Attribute Value
BrowseNameSystemStatusChangeEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the SystemEventType defined in 6.4.28, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableSystemStateServerStatePropertyTypeMandatory
Conformance Units
Base Info System Status Underlying System
Base Info System Status

This EventType inherits all Properties of the SystemEventType. Their semantic is defined in 6.4.28. The SourceNode Property and the SourceName shall identify the system. The system can be the Server itself or some underlying system.

The SystemState specifies the current state of the system. Changes to the ServerState of the system shall trigger a SystemStatusChangeEvent, when the event is supported by the system.

6.4.31 BaseModelChangeEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 55.

Table 55 – BaseModelChangeEventType definition
Attribute Value
BrowseNameBaseModelChangeEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info Model Change

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. There are no additional Properties defined for this EventType. The SourceNode Property for Events of this type shall be the Node of the View that gives the context of the changes. If the whole AddressSpace is the context, the SourceNode Property is set to the NodeId of the Server Object. The SourceName for Events of this type shall be the String part of the BrowseName of the View; for the whole AddressSpace it shall be "Server".

6.4.32 GeneralModelChangeEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 56.

Table 56 – GeneralModelChangeEventType definition
Attribute Value
BrowseNameGeneralModelChangeEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the BaseModelChangeEventType defined in 6.4.31, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableChangesModelChangeStructureDataType[]PropertyTypeMandatory
Conformance Units
Base Info Model Change General

This EventType inherits all Properties of the BaseModelChangeEventType. Their semantic is defined in 6.4.31.

The additional Property defined for this EventType reflects the changes that issued the ModelChangeEvent. It shall contain at least one entry in its array. Its structure is defined in 12.16.

6.4.33 SemanticChangeEventType

This EventType is defined in OPC 10000-3. Its representation in the AddressSpace is formally defined in Table 57.

Table 57 – SemanticChangeEventType definition
Attribute Value
BrowseNameSemanticChangeEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableChangesSemanticChangeStructureDataType[]PropertyTypeMandatory
Conformance Units
Base Info SemanticChange

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. The SourceNode Property for Events of this type shall be the Node of the View that gives the context of the changes. If the whole AddressSpace is the context, the SourceNode Property is set to the NodeId of the Server Object. The SourceName for Events of this type shall be the String part of the BrowseName of the View, for the whole AddressSpace it shall be "Server".

The additional Property defined for this EventType reflects the changes that issued the SemanticChangeEvent. Its structure is defined in 12.17.

6.4.34 EventQueueOverflowEventType

EventQueueOverflow Events are generated when an internal queue of a MonitoredItem subscribing for Events in the Server overflows. OPC 10000-4 defines when the internal EventQueueOverflow Events shall be generated.

The EventType for EventQueueOverflow Events is formally defined in Table 58.

Table 58 – EventQueueOverflowEventType definition
Attribute Value
BrowseNameEventQueueOverflowEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
Conformance Units
Base Info EventQueueOverflow EventType

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Server Object. The SourceName for Events of this type shall be "Internal/EventQueueOverflow".

6.4.35 ProgressEventType

ProgressEvents are generated to identify the progress of an operation. An operation can be a Service call or something application specific like a program execution.

The EventType for Progress Events is formally defined in Table 59.

Table 59 – ProgressEventType definition
Attribute Value
BrowseNameProgressEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the BaseEventType defined in 6.4.2, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableContextBaseDataTypePropertyTypeMandatory
HasPropertyVariableProgressUInt16PropertyTypeMandatory
Conformance Units
Base Info Progress Events

This EventType inherits all Properties of the BaseEventType. Their semantic is defined in 6.4.2. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Session Object where the operation was initiated. The SourceName for Events of this type shall be "Service/<Service Name as defined in OPC 10000-4>" when the progress of a Service call is exposed.

The additional Property Context contains context information about what operation progress is reported. In the case of Service calls it shall be a UInt32 containing the requestHandle of the RequestHeader of the Service call.

The additional Property Progress contains the percentage completed of the progress. The value shall be between 0 and 100, where 100 identifies that the operation has been finished.

It is recommended that Servers only expose ProgressEvents for Service calls to the Session that invoked the Service.

6.4.36 AuditClientEventType

This EventType is used for the categorization of Events generated by a Client. Its representation in the AddressSpace is formally defined in Table 60.

Table 60 – AuditClientEventType definition
Attribute Value
BrowseNameAuditClientEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditEventType defined in 6.4.3, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableServerUriUriStringPropertyTypeMandatory
ConformanceUnits
Base Info Client Events

This class of Audit Events are generated by Servers that also support Client functionality. They represent the Client actions taken by the Server.

This EventType inherits all Properties of the AuditEventType. Their semantics are defined in 6.4.3. The SourceNode Property for Events of this type shall be assigned to the NodeId of the Object that is related to the action. If no Object is related, then the SourceNode Property shall be the NodeId of the Server Object.

ServerUri provides the URI of the Server that the Client was accessing.

6.4.37 AuditClientUpdateMethodResultEventType

This EventType allows Method calls issued by a Client to be audited. Its representation in the AddressSpace is formally defined in Table 61.

Table 61 – AuditClientUpdateMethodResultEventType definition
Attribute Value
BrowseNameAuditClientUpdateMethodResultEventType
IsAbstractTrue
References NodeClass BrowseName DataType TypeDefinition ModellingRule
Subtype of the AuditClientEventType defined in 6.4.36, which means it inherits the InstanceDeclarations of that Node.
HasPropertyVariableObjectIdExpandedNodeIdPropertyTypeMandatory
HasPropertyVariableMethodIdExpandedNodeIdPropertyTypeMandatory
HasPropertyVariableStatusCodeIdStatusCodePropertyTypeMandatory
HasPropertyVariableInputArgumentsBaseDataType[]PropertyTypeMandatory
HasPropertyVariableOutputArgumentsBaseDataType[]PropertyTypeMandatory
ConformanceUnits
Base Info Client Events

This EventType inherits all Properties of the AuditClientEventType. Their semantics are defined in 6.4.36. The SourceName for Events of this type shall be "Client/Call". A single Client action may generate several Events of this type, one per Method called.

ObjectId identifies the Object on which the Method was called. The ExpandedNodeId shall use a namespaceUri, the serverIndex shall be set to 0 and the serverIndex shall be ignored.

MethodId identifies the method that was called. The ExpandedNodeId shall use a namespaceUri, the serverIndex shall be set to 0 and the serverIndex shall be ignored.

The ServerUri in the parent class is used to represent the Server that the Client accessed instead of the ExpandedNodeId serverIndex.

StatusCodeId identifies the overall status returned by the Method Call.

InputArguments identifies the input arguments for the method. This parameter can be null if no input arguments were provided.

OutputArguments identifies the output arguments of the method. This parameter can be null if no output arguments were returned.