As part of the Historical Event Logs service we will provide logs for either a specific User, Record or Organization and will cover the following logged Event record types:
Important: It is the customers' responsibility to interpret and determine the actions taken during a Users session. Salesforce support can only provide guidance in understanding the logged event records.
- Login along with Source IP, URI and the time stamp (GMT)
- Pages accessed via the user interface (This includes Visualforce pages)
- Viewed and run reports
- Exported Reports (When a user clicks on “Export Details”)
- Global searches
Each logged Event will contain the following information:
- Time stamp in the form of Year, Month, Day, Time in Hours, Minutes, Seconds and Milliseconds (GMT)
- Organization ID, User ID for the target user/ record
- Browser type
- Source IP
- Client name
Note: If you have any questions regarding the process and what we can provide you then please log a case with Support . We'd be happy to clarify any questions or concerns around this service.
An alternative auditing tool that can be used to capture Organization-wide Events would be to setup your own Event Log Files. This is a Self Service option which can be used to understand your Organization's trends.
Historical Event Logs can be used to determine the following:
- To check what a target user has accessed while using Salesforce or information related to changes made to a specific record via the user interface.
- The following changes can be tracked during the User's logged in session: Record’s created, viewed, edited, updated and deleted.
- If the customer did a mass delete, there would only be one log line. However, the Setup Audit Trail does capture the activity when the mass delete tool is used.
- The information provided in the logs will not contain the old and new values of the record. Any record modified via an API will not be tracked. Examples of this would be: API integrations, applications, and Custom Apex queries.
Good to know:
- For exported reports that were not saved please refer to the following article our Help article "Interpreting Report Metadata from Security Logs" (We will not be able to recreate any data in the Organization, such as rebuilding the reports using the metadata).
- If a record is deleted we won't be able to reference the record in your Organization. The only way to know what record was deleted you will need to have a reliable backup of your data.
- The Salesforce Security Team will run logs when this information is required. Due to security reasons, the requesting user must have a System Administrator profile or be a Designated Contact to open the case.
Overview of Historical Event Logs
This process takes approximately two to three weeks after the initiation of this process which occurs once we get confirmation that you agree to the associated charges. The delivery time frame will differ depending on the date range of the logs request as well as the amount of data that is captured.
For logs related to a User:
From January 2013 – Present: USD $500 for data per week or 7 continuous days per user
Example: total charge = USD $500 ( $500= for each week requested x 1 user)
For logs related to a specific record:
From January 2013 – Present: USD $500 for data per record per week or 7 continuous days
Example: total charge = USD $500 ($500 = for each week requested x 1 record)
For logs related to a specific Organization:
From January 2013 – Present: USD $500 for data per org per day with a max $7,500 for 1 month (Up to 31 continuous days)
Example: total charge = USD $3500 for 7 days ($500 = for each day requested x 1 org)
= USD $7,500 for 21 days ($500 = for each day up to 15 days with no added charge for each additional day)
An invoice will be generated by our Sales Team and will be associated with the account that the user / specific record / organization where the Log Files were requested. You can call the following number (1-800-667-6389) and select option # 3 for Billing to discuss your payment options.
Note: Please be aware that if no data is found during the time frame requested the applicable charges will still apply. An invoice will be generated for this process and will be billed to the customer Organization as per initiation by Salesforce.
This information is required from your end to initiate this process with Salesforce
- User ID for target user OR record ID.
- Organization ID.
- Date range required for Logs
Download the logs
- Once the logs are completed they will be attached onto the case.
- Go to Help and Training and view your case attachments. Click on the attachment and save it.
- The log files will be delivered in either of the following formats .CSV and .XLS depending on file size.
- You can then interpret the Forensic Logs.