What the Audit Log Object Is
The Audit Log object, defined in Clause 12.64 of ANSI/ASHRAE 135-2024, records auditable operations on a BACnet device into an internal buffer for later retrieval. It combines audit notifications from operation sources and operation targets, merges the two sides of each operation into a single record, and timestamps it. The result is a tamper-evident history of who did what on the network, the audit trail behind BACnet’s revision-22 security model.
Each Audit Log keeps a persistent, optionally fixed-size buffer that overwrites its oldest records when full. The buffer is read back as a list of audit records with the ReadRange service (and the AuditLogQuery service), and Total_Record_Count supplies the sequence number for each record. Unlike other logging objects, the Audit Log does not use the BUFFER_READY event algorithm; when it supports intrinsic reporting it does so for fault conditions only and applies no event algorithm. An Audit Log may optionally forward its records to a parent Audit Log for buffered, bulk collection.
Where You’ll See It
- Security audit trail. An Audit Log captures configuration writes, commands, and other auditable operations so operators can review what changed and when.
- Central collection. Field devices forward their audit records to a parent Audit Log on a supervisory device, which buffers them for bulk transfer to the audit system.
- Compliance retrieval. A head end (the central BMS server) pulls the accumulated records with ReadRange to satisfy an audit or investigate an incident.
Required Properties
Clause 12.64 requires every Audit Log object to provide these properties. Datatypes are the spec’s names: Unsigned32 and Unsigned64 are integers, BOOLEAN a true/false flag, BACnetLIST of BACnetAuditLogRecord the timestamped buffer, and the other BACnet-prefixed types are structured values defined by the standard. Enable is writable.
| Property | Datatype | What it holds |
|---|---|---|
Object_Identifier | BACnetObjectIdentifier | The object’s type and instance number, unique within the device |
Object_Name | CharacterString | The human-readable point name, unique within the device |
Object_Type | BACnetObjectType | Always audit-log for this object |
Status_Flags | BACnetStatusFlags | Four health flags: in-alarm, fault, overridden, out-of-service |
Event_State | BACnetEventState | The object’s current event state (normal or fault for this object type) |
Enable | BOOLEAN | Writable; turns audit logging on and off, itself recorded in the buffer |
Buffer_Size | Unsigned32 | The maximum number of records the buffer holds |
Log_Buffer | BACnetLIST of BACnetAuditLogRecord | The stored timestamped audit records, read with ReadRange |
Record_Count | Unsigned64 | The number of records currently in the buffer |
Total_Record_Count | Unsigned64 | The running total of records ever collected, used as the sequence number |
Property_List | BACnetARRAY[N] of BACnetPropertyIdentifier | The list of properties this instance actually implements |
Optional Properties
The properties integrators meet most are the forwarding group (Member_Of, Delete_On_Forward, Issue_Confirmed_Notifications) that sends records to a parent log. The intrinsic-reporting group, present for fault reporting, generally appears or is absent as a set.
| Property | Datatype | Group |
|---|---|---|
Description | CharacterString | General |
Member_Of | BACnetDeviceObjectReference | Logging |
Delete_On_Forward | BOOLEAN | Logging |
Issue_Confirmed_Notifications | BOOLEAN | Logging |
Event_Detection_Enable | BOOLEAN | Intrinsic reporting |
Notification_Class | Unsigned | Intrinsic reporting |
Event_Enable | BACnetEventTransitionBits | Intrinsic reporting |
Acked_Transitions | BACnetEventTransitionBits | Intrinsic reporting |
Notify_Type | BACnetNotifyType | Intrinsic reporting |
Event_Time_Stamps | BACnetARRAY[3] of BACnetTimeStamp | Intrinsic reporting |
Event_Message_Texts | BACnetARRAY[3] of CharacterString | Intrinsic reporting |
Event_Message_Texts_Config | BACnetARRAY[3] of CharacterString | Intrinsic reporting |
Reliability | BACnetReliability | Fault detection |
Reliability_Evaluation_Inhibit | BOOLEAN | Fault detection |
Audit_Level | BACnetAuditLevel | Auditing |
Auditable_Operations | BACnetAuditOperationFlags | Auditing |
Tags | BACnetARRAY[N] of BACnetNameValue | Tagging and profile |
Profile_Location | CharacterString | Tagging and profile |
Profile_Name | CharacterString | Tagging and profile |
Related Objects
- Audit Reporter: originates the audit notifications an Audit Log collects and stores.
- Trend Log: the general property-history logger, where the Audit Log records auditable operations instead.
- Event Log: records event notifications, another retrievable log buffer.
What Chipkin Provides
The Audit Log object is modeled in the CAS BACnet Stack with its buffer and retrieval properties, and the audit service dispatch is implemented; populated-record audit capture is a roadmap item. Talk to us about modeling your device’s points.