CTT Audit Event Test |OPC UA Standard|Forum|OPC Foundation

Avatar
Search
Forum Scope


Match



Forum Options



Minimum search word length is 3 characters - maximum search word length is 84 characters
Lost password?
sp_Feed sp_PrintTopic sp_TopicIcon
CTT Audit Event Test
Avatar
Adam Wu
Member
Members
Forum Posts: 4
Member Since:
06/17/2024
sp_UserOfflineSmall Offline
1
10/28/2024 - 17:59
sp_Permalink sp_Print

Hello

I currently used CTT Testing Audit Event,but CTTs behavior seems strange

To clearify where went wrong,I only use AuditSession Event and AuditActivateSession Event

When CTT runs test,CTT will received many types events,but most of them were not send from my opcua server.

I checked what CTT received AuditActivateSession Event, number of Event fields was not correct,also I checked its value,were not correct neither

I have also set Event NodeID,when CTT triggers Event Node,my opcua server will emit AuditActivateSession Event,but I checked CTT Test Script,there is no triggering Event Node Id

I also use uaExpert to check if there goes wrong with my server when my server sends AuditActivateSession Event

Every Event field is correct,and value also

I also created a opcua client to monitor server if server emits Event,and my client can received AuditActivateSession Event

And Event filed is correct,there are some value not correct because I did not deal its type correctly,but its behavior is correct

 

According to specification of OPCUA 

If server clams having audit event,when securechannel established server should emit SecureChannel Event and SecureChannelOpen Event

Seesion Event as well when Session created

Is there something I misunderstood about Audit Event?

 

belows link include CTT Audit Event Test Log. pictures for uaExpert and My opcua client to receive Audit Event

https://drive.google.com/file/…..sp=sharing

Thanks

Avatar
Paul Hunkar
Cleveland, Ohio, USA
Moderator
Members

Moderators-Specifications

Moderators-Companion

Moderators-Implementation

Moderators-Certification

Moderators-COM
Forum Posts: 112
Member Since:
02/24/2014
sp_UserOfflineSmall Offline
2
11/11/2024 - 07:40
sp_Permalink sp_Print

Audit event testing is a little different then other testing in the CTT.  This is do to the nature of Audit Events.  Audit event are generate when actions are taken in a server – such as establishing a secure connection, writing values to the server, or in general making any changes to the server. Support for Audit Event requires that your server will generate Audit events for all actions that are supposed to generate an Audit Event

Since Audit event are only generated as the result of other action in the server, to test Audit event using the CTT, what is required is that you also check all functionality that the server exposes in addition to the Audit checks. Allow the CTT to run all of these tests.  These tests will trigger records about action that should have triggered an Audit event.  With The Audit testing checked the CTT will have saved all of the Audit events that were generated during the CTT run.  When all other tests are complete the review of these event will be conduct comparing them to what should have been generated by the results of the other tests.

Paul Hunkar - DSInteroperability

Avatar
Adam Wu
Member
Members
Forum Posts: 4
Member Since:
06/17/2024
sp_UserOfflineSmall Offline
3
11/18/2024 - 21:15
sp_Permalink sp_Print

Hello,Paul

Thanks for your reply

CTT should collect all Audit Events send from Server during Audit Event Test,then parse collected Event datas to get what test needed,am i right?

The interesting thing is that even My Server did not send any Audit Event during Audit Event Test,but CTT still can collect several Audit Event

Thats why i am quite confusing about Audit Test on CTT

Thanks

Avatar
Adam Wu
Member
Members
Forum Posts: 4
Member Since:
06/17/2024
sp_UserOfflineSmall Offline
4
11/26/2024 - 00:48
sp_Permalink sp_Print

Hello,Paul

I think i figured out how CTT tests Audit Event, CTT uses ClientAuditEntryId to verify if server sends event with same ClientAuditEntryId.If matches CTT will receive Event Datas

CTT uses current time format as ClientAuditEntryId.

For ClientAuditEntryId,specification does not define it. About ClientAuditEntryId field,it could be any kinds of data,right?

Thanks

Forum Timezone: America/Phoenix
Most Users Ever Online: 510
Currently Online:
Guest(s) 22
Currently Browsing this Page:
1 Guest(s)
Top Posters:
Forum Stats:
Groups: 2
Forums: 10
Topics: 1444
Posts: 4887