EventFilter

How an event subscription differs from a data subscription

You monitor the EventNotifier attribute, not Value, on a node that raises events. The usual target is the Server object at i=2253, which by convention aggregates events from the whole server; a specific machine object is better when you want only that machine's events. Without an EventFilter you get nothing useful: the select clause defines the fields, so an empty select clause means empty events.

Filter server-side, not client-side

The where clause is evaluated by the server before anything goes on the wire. On a plant server that raises thousands of events per minute, an OfType restriction plus a Severity threshold is the difference between a subscription that works and one that overflows its queue. Filtering after delivery costs bandwidth, server CPU and queue space you cannot get back.

Simple and advanced filters in tooling

OPC Publisher exposes exactly this ladder: a simple mode where you give a source node and an event type and it generates the select and where clauses for you, and an advanced mode where you write both explicitly. It also supports periodic condition snapshot reporting. Start simple, move to explicit clauses when you need ConditionClassId or a severity band. Modern client stacks wrap the same thing in a fluent alarm event filter builder.

When the server says no

A malformed filter comes back as BadEventFilterInvalid or BadFilterOperandInvalid, usually because a browse path in a select clause does not exist on the declared typeDefinitionId, or because a where clause references an operand the server cannot resolve. A filter that is valid but unsupported gives BadMonitoredItemFilterUnsupported. Check the per-clause diagnostic results in the response rather than guessing: the service returns a result for each select clause.

Example

An EventFilter as sent on the wire, conceptually

CreateMonitoredItems
  ItemToMonitor:
    NodeId       = i=2253          (Server object)
    AttributeId  = EventNotifier
  RequestedParameters:
    QueueSize    = 1000            (events are bursty; do not use 1)
    DiscardOldest= false           (keep the first events of a burst)
    Filter       = EventFilter {
      SelectClauses = [
        BaseEventType /EventId,
        BaseEventType /EventType,
        BaseEventType /SourceNode,
        BaseEventType /Time,
        BaseEventType /Severity,
        BaseEventType /Message,
        ConditionType /ConditionClassId,
        AlarmConditionType /ActiveState/Id
      ]
      WhereClause = ContentFilter {
        OfType(ConditionType) AND (Severity >= 500)
      }
    }

Defined in: Part 4 - Services defines EventFilter and ContentFilter; Part 9 defines the condition fields you select.

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.