What AuditLogQuery Is
AuditLogQuery is an alarm-and-event service in BACnet, defined in Clause 13.19 of ANSI/ASHRAE 135-2024. It gives a client efficient, filtered access to the records in an Audit Log object. Where ReadRange pulls back a span of raw log records, AuditLogQuery lets the client ask the device to return only the records matching a filter, which is far cheaper when an audit trail is large. It is a confirmed service.
Audit logging records who did what to a device (which operations changed which properties, and when). AuditLogQuery is how an auditing workstation retrieves the relevant slice of that history without downloading the whole log.
How It Works
The client sends a query naming the target Audit Log object and a set of filter parameters: a target device, object, property, and a time range to match against the stored records. The device compares each audit record against the filter and returns the matching records. The spec is explicit that the device does not validate the filter for internal consistency; it simply performs the comparison, so a filter that matches nothing returns nothing rather than an error.
Where You’ll See It
- Audit review. An operator or security tool retrieving the history of changes to a device or a specific point.
- Compliance reporting. Pulling the record of who changed a setpoint or a configuration property over a time window.
- Targeted retrieval. Fetching only the audit records that touch one object, instead of reading the whole Audit Log buffer with ReadRange.
AuditLogQuery Error Codes
Clause 13.19 defines the error class and code returned for each failure. The general error model is in Clause 18 of the standard.
| Situation | Error class | Error code |
|---|---|---|
| The specified Audit Log object does not exist | OBJECT | UNKNOWN_OBJECT |
| The device is not configured to perform audit logging | SERVICES | OPTIONAL_FUNCTIONALITY_NOT_SUPPORTED |
Reading these in the field: OPTIONAL_FUNCTIONALITY_NOT_SUPPORTED means the device has no audit logging enabled (or does not implement it), not that the query was malformed. A query that matches no records is not an error; it returns an empty result.
Profiles That Require It
AuditLogQuery is a specialty service tied to audit reporting, not a baseline requirement. On the device side, it is executed by devices that host an Audit Log and support audit retrieval. On the client side, it is initiated by the advanced operator profiles that present audit history, such as B-AWS through its audit-reporting capability. The minimal profiles do not require it.
What Chipkin Provides
Audit logging and the AuditLogQuery service are part of Chipkin’s BACnet audit roadmap on the CAS BACnet Stack. Talk to us about audit logging and adding BACnet client or server support to your device.