Monitoring OPC UA Events

This tutorial shows you how to monitor OPC UA events emitted by objects on an OPC UA server. Events are used for alarms, notifications, and state changes in OPC UA systems.

Unlike variable monitoring which tracks value changes, event monitoring captures discrete occurrences like alarms activating, equipment state changes, or user actions.

Prerequisites

An active connection to an OPC UA server (see Create a connection)
A subscription configured in the connection endpoint
An OPC UA server that emits events
Knowledge of the object that generates events (typically the Server object or equipment nodes)

What are OPC UA Events?

OPC UA events are notifications emitted by objects when something occurs:

Common Event Types:

Alarms: Critical conditions requiring attention (high temperature, pressure limit)
Conditions: State changes (equipment starting, stopping)
Audit Events: User actions, security events
System Events: Server status changes, diagnostics

Events carry structured information defined by their event type, such as severity, message, timestamp, and custom fields.

Basic Configuration

Monitor Event Node Setup

Name: Descriptive name for the node
Endpoint: Select your OPC UA server connection
Subscription: Choose an existing subscription
Where Clause: Optional filter to select specific event types
Select Clause: Fields to retrieve from the event

Example: Monitor All Events

Monitor all events from the Server object:

[
    {
        "id": "monitor-event1",
        "type": "OpcUa-MonitorEvent",
        "name": "All Server Events",
        "endpoint": "opcua_endpoint1",
        "subscription": "subscription1",
        "nodeId": "i=2253",
        "whereClause": "",
        "selectClause": "EventId,EventType,SourceName,Time,Message,Severity"
    },
    {
        "id": "debug1",
        "type": "debug",
        "name": "Show Events"
    }
]

Configuration:

NodeId: i=2253 (Server object - standard OPC UA)
Where Clause: Empty (all events)
Select Clause: Common event fields

Expected Output

{
    "payload": {
        "EventId": "...",
        "EventType": "ns=0;i=2041",
        "SourceName": "Server",
        "Time": "2024-11-24T10:30:45.123Z",
        "Message": "System event occurred",
        "Severity": 500
    }
}

Filtering Events with Where Clause

Use the Where Clause to filter specific event types:

Monitor Only Alarm Events

ofType("AlarmConditionType")

This filters to only receive alarm condition events.

Monitor Specific Equipment

Monitor events from a specific piece of equipment:

{
    "nodeId": "ns=2;s=Equipment.Reactor1",
    "whereClause": "ofType('AlarmConditionType')"
}

Common Where Clause Patterns

By Event Type:

ofType("SystemEventType")
ofType("AuditEventType")
ofType("AlarmConditionType")

By Severity:

// High severity events (>= 700)
Severity >= 700

By Source:

// Events from specific source
SourceName = "Reactor1"

Selecting Event Fields

The Select Clause determines which fields are returned in the event notification.

Basic Event Fields

EventId,EventType,SourceName,Time,Message,Severity

Field Descriptions:

EventId: Unique identifier for this event occurrence
EventType: NodeId of the event type definition
SourceName: Name of the object that generated the event
Time: When the event occurred
Message: Human-readable description
Severity: Importance level (1-1000, higher = more severe)

Alarm-Specific Fields

For alarm events, add alarm-specific fields:

EventId,SourceName,Time,Message,Severity,ActiveState,AckedState,ConditionName

Additional Fields:

ActiveState: Whether alarm is currently active
AckedState: Whether alarm has been acknowledged
ConditionName: Name of the alarm condition

Using the Graphical Selector

The easiest way to select fields:

Open the Monitor Event node configuration
Click the ... button next to Select Clause
Browse the event type hierarchy
Check the fields you want
The Select Clause is automatically generated

Example: Monitor Equipment Alarms

Monitor alarms from a reactor with relevant fields:

[
    {
        "id": "inject1",
        "type": "inject",
        "name": "Start Monitoring",
        "once": true
    },
    {
        "id": "monitor-event1",
        "type": "OpcUa-MonitorEvent",
        "name": "Reactor Alarms",
        "endpoint": "opcua_endpoint1",
        "subscription": "subscription1",
        "nodeId": "ns=2;s=Equipment.Reactor1",
        "whereClause": "ofType('AlarmConditionType')",
        "selectClause": "EventId,Time,Message,Severity,SourceName,ActiveState,AckedState"
    },
    {
        "id": "function1",
        "type": "function",
        "name": "Process Alarm",
        "func": `
const event = msg.payload;

// Check if alarm is active and not acknowledged
if (event.ActiveState && !event.AckedState) {
    msg.payload = {
        alarm: true,
        severity: event.Severity,
        message: event.Message,
        source: event.SourceName,
        time: event.Time
    };
    return msg;
}
return null;
        `
    },
    {
        "id": "debug1",
        "type": "debug",
        "name": "Active Alarms"
    }
]

Processing Function

// Function node: Process alarm events
const event = msg.payload;

// Check if this is an active, unacknowledged alarm
if (event.ActiveState && !event.AckedState) {
    msg.payload = {
        alarm: true,
        severity: event.Severity,
        message: event.Message,
        source: event.SourceName,
        time: event.Time,
        urgent: event.Severity >= 800
    };
    return msg;
}

// Ignore inactive or acknowledged alarms
return null;

Example: Alarm Dashboard

Create a simple alarm notification system:

// Function node: Format for dashboard
const event = msg.payload;

// Determine severity level
let level = "info";
if (event.Severity >= 800) {
    level = "critical";
} else if (event.Severity >= 600) {
    level = "warning";
} else if (event.Severity >= 400) {
    level = "notice";
}

// Format for UI
msg.payload = {
    level: level,
    title: event.SourceName,
    message: event.Message,
    timestamp: new Date(event.Time),
    active: event.ActiveState,
    acknowledged: event.AckedState
};

return msg;

Event Severity Levels

OPC UA defines standard severity ranges (0-1000):

Range	Level	Description
1-200	Low	Informational events
201-400	Low-Medium	Minor issues
401-600	Medium	Noteworthy conditions
601-800	Medium-High	Important warnings
801-1000	High	Critical alarms

Example Filter:

// Only critical and high-severity events
Severity >= 600

Multiple Event Monitors

Monitor different event types with multiple nodes:

[
    {
        "id": "monitor-alarms",
        "type": "OpcUa-MonitorEvent",
        "name": "Alarms",
        "whereClause": "ofType('AlarmConditionType')"
    },
    {
        "id": "monitor-audits",
        "type": "OpcUa-MonitorEvent",
        "name": "Audit Events",
        "whereClause": "ofType('AuditEventType')"
    },
    {
        "id": "monitor-system",
        "type": "OpcUa-MonitorEvent",
        "name": "System Events",
        "whereClause": "ofType('SystemEventType')"
    }
]

Tips & Best Practices

For comprehensive best practices and optimization techniques, see:

👉 Tips & Best Practices for Event Monitoring

Key topics covered:

Filtering strategies and Where Clause optimization
Field selection best practices
Event rate management and aggregation
Performance optimization
Alarm management patterns
Event processing patterns

Common Use Cases

Alarm Notification System

Send email or SMS for critical alarms:

// Function node: Critical alarm notification
if (msg.payload.Severity >= 800 && msg.payload.ActiveState) {
    msg.topic = "Critical Alarm";
    msg.payload = {
        to: "operator@example.com",
        subject: `Critical Alarm: ${msg.payload.SourceName}`,
        body: `${msg.payload.Message}\nTime: ${msg.payload.Time}`
    };
    return msg;
}
return null;

Alarm Logging

Log all alarms to a database:

// Function node: Prepare for database
msg.topic = "INSERT INTO alarm_log (time, source, message, severity, active) VALUES (?, ?, ?, ?, ?)";
msg.params = [
    msg.payload.Time,
    msg.payload.SourceName,
    msg.payload.Message,
    msg.payload.Severity,
    msg.payload.ActiveState
];
return msg;

Event Counter

Count events by type and severity:

// Function node: Event statistics
const stats = flow.get('eventStats') || {};
const event = msg.payload;

const key = `${event.SourceName}_${event.Severity}`;
stats[key] = (stats[key] || 0) + 1;

flow.set('eventStats', stats);

msg.payload = stats;
return msg;

Troubleshooting

For detailed troubleshooting guidance and solutions to common problems, see:

👉 Troubleshooting Event Monitoring

Common issues covered:

No events received
Too many events
Missing event fields
Events delayed
Connection issues
Where Clause errors
Memory issues

Event Types Reference

Standard Event Types

BaseEventType: Root of all events

EventId, EventType, SourceName, Time, Message, Severity

SystemEventType: System events

Server start/stop, configuration changes

AlarmConditionType: Alarms and conditions

ActiveState, AckedState, ConfirmedState, Retain

AuditEventType: Security and user actions

ActionTimeStamp, Status, ServerId, ClientAuditEntryId

Next Steps

Tips & Best Practices - Optimization and best practices
Troubleshooting - Solutions to common problems
Monitor Variables - Monitor value changes
Explore - Discover event-generating objects
Connection - Configure subscriptions

Prerequisites​

What are OPC UA Events?​

Basic Configuration​

Monitor Event Node Setup​

Example: Monitor All Events​

Expected Output​

Filtering Events with Where Clause​

Monitor Only Alarm Events​

Monitor Specific Equipment​

Common Where Clause Patterns​

Selecting Event Fields​

Basic Event Fields​

Alarm-Specific Fields​

Using the Graphical Selector​

Example: Monitor Equipment Alarms​

Processing Function​

Example: Alarm Dashboard​

Event Severity Levels​

Multiple Event Monitors​

Tips & Best Practices​

Common Use Cases​

Alarm Notification System​

Alarm Logging​

Event Counter​

Troubleshooting​

Event Types Reference​

Standard Event Types​

Next Steps​

See Also​