Salesforce Event Monitoring Frequently Asked Questions

Frequently Asked Questions  

• How long are logs retained?
• Can I change the retention period for EventLogFile to one year?
• How do I enable Event Monitoring?
• Is there a way to test Event Monitoring before purchasing?
• How can I retrieve logs?
• Do logs consume organization storage?
• Why can't I retrieve logs in a Sandbox despite having a contract?
• Are field value changes or configuration changes recorded?
• Can I track record access or report exports?
• What is the time zone for event log files?

How long are logs retained?

Event log retention periods vary depending on your organization's edition and subscription status.

• Developer Edition: Access to all event types is available, with a retention period of 1 day.
• Enterprise / Unlimited / Performance Editions:
  • Free Version: Access to limited event types only, with a retention period of 1 day.
  • Paid Version (with Add-on): Access to all log files. Logs are retained for 30 days by default and can be extended up to 1 year (365 days).

Note:

• Paid logs cannot be retrieved retroactively for periods before the contract start date.
• For details on event types available for free, refer to the notes in "EventLogFile Supported Event Types."

Can I change the retention period for EventLogFile to one year?

If your organization has Salesforce Shield or the Salesforce Event Monitoring add-on, you can extend the retention period to one year using these steps:

1. From Setup, enter "Event Monitoring Settings" in the Quick Find box, then select Event Monitoring Settings.
2. Turn on Retain Event Logs.

Note: To customize a specific duration between 30 and 365 days, you must use the eventLogRetentionDuration field in the Metadata API (EventSettings) instead of the UI.

How do I enable Event Monitoring?

• With Add-on: Organizations with Salesforce Shield or Salesforce Event Monitoring subscriptions are opted-in to receive event log files by default.
• Without Add-on: Since the Summer ’23 release, you must manually opt-in to receive logs:
  1. From Setup, enter "Event Monitoring Settings" in the Quick Find box, then select Event Monitoring Settings.
  2. Turn on Generate Event Log Files and save.

Note: Real-Time Event Monitoring is configured via Event Manager in Setup.

Is there a way to test Event Monitoring before purchasing?

In Developer Edition organizations, you can access all event types for free with 1-day data retention. You can sign up for a free Developer Edition via the Salesforce Developers site.

How can I retrieve logs?

• API Tools: Use Data Loader to export logs.
• Browser: Use the "Event Log File Browser" in the Setup menu for direct downloads.

Do logs consume organization storage?

No, log files do not count toward your organization’s data or file storage limits.

Why can't I retrieve logs in a Sandbox despite having a contract?

If logs are not appearing in a Sandbox even with a valid add-on subscription, check the following:

• License Sync: Sandboxes created before the add-on contract may not have the license. Go to Company Information and click Match Production Licenses.

• Settings: Ensure Generate Event Log Files is turned on in the Sandbox’s Event Monitoring Settings.

Are field value changes or configuration changes recorded?

Only events listed in "EventLogFile Supported Event Types" are recorded. Specific details, such as old/new field values or specific configuration changes, are generally not included in these logs.

Can I track record access or report exports? 

• Record Access: Use the URI or Lightning Page View event types.
• Report Exports: Use the Report Export event type.

Refer to "EventLogFile Supported Event Types" for a full list of trackable activities.

What is the time zone for event log files?

The time zone for the TIMESTAMP field in all Event Monitoring log files is UTC (GMT). This time zone setting cannot be changed.