Loading

Salesforce Historical Event Logs process and service fees

Publiseringsdato: Aug 11, 2025
Beskrivelse

The Historical Event Logs Process is a paid add on service process offered by Salesforce to investigate record, org and or user activity. As part of the Historical Event Logs service we will provide logs for either a specific User, Record or Organization. 
 
IMPORTANT 
Salesforce can pull log information up to 30 days prior to order confirmation date, which is in accordance with our existing data retention policies. Please ensure your required time frame falls within 30 days at the time of case creation.

Below is a summary of the projected service fees and costs based on the log type requested:

For logs related to a User:

USD $500 for data per week or 7 continuous days per user
Example: total charge = USD $500 ( $500= for each week requested  x 1 user) 

For logs related to a specific record:

USD $500 for data per record per week or 7 continuous days
Example: total charge = USD $500 ($500 = for each week requested x 1 record)

For logs related to a specific Organization:

USD $500 for data per org per day with a max $7,500 for 1 month (Up to 31     continuous days)
Example: total charge  = USD $3500 for 7 days ($500 = for each day requested x 1 org).

= USD $7,500 for 21 days ($500 = for each day up to 15 days with no added charge for each additional day) 

 

What the logs can provide

As part of the Historical Event Logs service we will provide logs for either a specific User, Record or Organization and will cover the following logged Event record types

  • Login along with Source IP, URI and the time stamp (GMT)
  • Pages accessed via the user interface (This includes Visualforce pages)
  • Viewed and run reports
  • Exported Reports (When a user clicks on “Export Details”)
  • If the customer did a mass delete, there would only be one log line. However, the Setup Audit Trail does capture the activity when the mass delete tool is used.
  • The information provided in the logs will not contain the old and new values of the record. Any record modified via an API will not be tracked. Examples of this would be: API integrations, applications and Custom Apex queries.


Each logged Event will contain the following information

  • Time stamp in the form of Year, Month, Day, Time in Hours, Minutes, Seconds and Milliseconds (GMT)
  • Organization ID, User ID for the target user or record
  • Browser type
  • Source IP
  • Client name
  • LogName/URI

 

Løsning

Frequently Asked Questions


How fast can I get the logs?

The delivery time frame will differ depending on the date range of the logs request as well as the amount of data that is captured.

Logs can be completed with an approximate ETA of two business days lead time.  Please clarify with the support agent on the approximate time required for your request and also review the required time frame with your support agent to ensure the logs for that period are still available. 


How does the invoice process work?
An invoice from Salesforce will be generated by our Sales Ops Team from the Organization from which Log Files were requested. Customers may also call the following number (1-800-667-6389) select option # 3 for Billing to discuss available payment options. 

What happens if there is no data found during the requested time frame?
The applicable charges will still apply and an invoice will be generated for this process. This will be billed to the customer organization so we recommend checking the user's login history for user requests first to ensure they have accessed Salesforce during the requested time.

Can the recovery process cost be waived?
No. Due to required manual intervention and operational costs of extracting data from our storage solution cost cannot be waived for this service. 

How can I interpret the logs?
You can use the following article to interpret the logs: Interpret forensic logs
It is the customers' responsibility to interpret and determine the actions taken during a Users session. Salesforce support can only provide guidance in understanding the logged event records.

How can I determine what report a user exported?
For exported reports that may not have been saved please refer to the following help and training article Interpreting Report Metadata from Security Logs
We will not be able to recreate any data in the Organization, such as rebuilding the reports using the metadata.

How do I download the logs?
Once the logs are completed they will be attached onto the case.

  • Go to Help and Training and view your case attachments.
  • Click on the attachment and save it.

The log files will be delivered in either of the following formats .CSV and .XLS depending on file size. Due to size and formatting limitations, the logs run for the entire Organization will be in the raw CSV format. The customer can format them using their own database tools

What if the record a user accessed, does not exist?
For best results, Salesforce recommends to have your data backed regularly. If a record is deleted, we won't be able to reference the record in your Organization. The only way to know what record was deleted will be to have a reliable backup that is updated regularly.

BEST PRACTICES: Data Backup & Recovery Best Practices

Can the historical logs also track what changes were made to a record?
Unfortunately, we can only tell you if a record was accessed and not what fields were modified or the pre and post modified value of a record. 

How do I initiate a request for the logs?
Due to security reasons, the requesting user must have a System Administrator profile or be a Designated Contact to open the Case. The request will be run by the Security Support team.

We will need the following information to run this request

  • UserID or RecordID
  • User’s email address:
  • User’s username:
  • Org ID:
  • Timeframe: Start date and End date
  • Approval: (Y/N)
  • Est Cost:


If you have any questions regarding the process, and what we can provide you, then please log a case with Support. We'd be happy to clarify any questions or concerns around this service.

Knowledge-artikkelnummer

000387307

 
Laster
Salesforce Help | Article