---
task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server, RESTful API)
version: R1.05 (first written for R1.03)
source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §1–§3, §4.2, §7, §10, §11; IM 36K10E20-01EN 4th ed. §2.2; practiced on the R1.03 test system 2026-10-01; re-checked read-only on the R1.05 test server 2026-10-08
status: verified on R1.05 (2026-10-08, read-only checks below); R1.03 results kept where marked
---

# ACCESS Service checks (read-only)

| Check | How | Result (R1.05 test server 2026-10-08 unless marked) |
|---|---|---|
| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line), a `javaw.exe` for the RESTful API server; `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running; no `odbsrv` (same on R1.03) |
| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 34597 (RESTful API, R1.04+), 135 (DCOM) | 34493 yes, 34597 yes, 135 yes, 1583 **no** (R1.03: same, no 34597) |
| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008; R1.03 and R1.05) |
| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `odbsrv.sup` identical to R1.03, `USESSL YES`, folder missing |
| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `ServerConfig.xml` — R1.05: `%TLS_SAV_PATH%\ServerConfig.xml` (R1.03: `%TLS_ROOT_PATH%\tls\exe`; ISS-081); ignore commented XML | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on (unchanged from R1.03; the R1.05 file only adds SDK sections) |
| Extended OPC UA functions | `findstr EXTENDED_FUNC` in `opxuas.sup` and in the client's `<process>.sup` (template `epauac_eqp.sup`) | `OPXUAS_ENABLE_EXTENDED_FUNC = NO`, `OPXC_ENABLE_EXTENDED_FUNC = NO` (product defaults): no OPC UA alarms, HistoryRead or PubSub until set to YES |
| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der`; client own `<host>_OPXUAC_MON.der`; server `rejected` absent until the first rejection |
| Certificate validity | `certutil -dump <file>.der` and look at `NotAfter` | Both own certificates valid 5 years from installation. The OPC UA client warns in the Historical Alarm Overview and the UMH message log before a client or server certificate expires (IM 36K10E20 4th ed. §2.2); lead time = hidden keyword `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in `epauac_eqp.sup` |
| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO`; new in R1.05: `OPXAES_DIR_ALM = YES` (A&E server, "Direct" alarm events; not in the manual, ISS-085) |
| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`, `OPCUAC_METHOD_CALL2_DF` | R1.03: only the sample loopback. R1.05: dataset structure of line, station, subscription and point unchanged |
| RESTful API settings | `tls\sup\jrstsrv.sup`: `JRST_NETWORK_PORT` (34597), `JRST_READ_ONLY_MODE` (product default YES), `JRST_MAX_RECORDS` (default 100), `JRST_USE_TWO_WAY_SSL` (NO), `JRST_USER_CACHE_TIME` (600 s), `JRST_CUSTOM_DATASETS`; API keys in dataset `API_KEYS_DF` (export without records in reports) | Keywords as in IM 36K10L45 5th ed. §4.2.1; compare the active values with the `!DEFAULT` block |
| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | `OPXUAS.log`, `OpxUas_Sdk*.log`, `OPXUAC_MON.log` present |

Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
(unencrypted ODBC traffic — a security decision), then restart CI Server.