The OPC UA AuditEvents can be used to trace different user actions (and related errors) which on the OPC UA server. However, it is not possible to tie all AuditEvents of one specific session together and follow the actions. The SessionId field would be usable, but this is only available for the AuditSession*EventTypes.

The AuditUpdateEventType (and Subtypes) as well as the AuditSecurityEventType do not contain a SessionId field. This prevents, that the SessionID which caused this action is transmitted in a generic way. Because of that, it is not possible to recover which client caused a certain operation. The included ClientUserId is not unique (as multiple session from different clients may use the same user), nor the AuditEntryId (which is user a controlled/client controlled value) reliable .

It would be possible to add the SessionId to the Message, but this would require vendor specific parsing of the messages within an audit system subscribing to these events, which is not a good either.

I would suggest adding the SessionId (type: NodeId) as optional field to the AuditEventType. This would allow following all UserActions which have been taken place in a single session.