This article provides an overview of Event Monitoring, including log retrieval methods, retention period specifications, and activation steps across different editions and Sandboxes.
Event log retention periods vary depending on your organization's edition and subscription status.
Note:
If your organization has Salesforce Shield or the Salesforce Event Monitoring add-on, you can extend the retention period to one year using these steps:
Note: To customize a specific duration between 30 and 365 days, you must use the eventLogRetentionDuration field in the Metadata API (EventSettings) instead of the UI.
Note: Real-Time Event Monitoring is configured via Event Manager in Setup.
In Developer Edition organizations, you can access all event types for free with 1-day data retention. You can sign up for a free Developer Edition via the Salesforce Developers site.
No, log files do not count toward your organization’s data or file storage limits.
If logs are not appearing in a Sandbox even with a valid add-on subscription, check the following:
License Sync: Sandboxes created before the add-on contract may not have the license. Go to Company Information and click Match Production Licenses.
Only events listed in "EventLogFile Supported Event Types" are recorded. Specific details, such as old/new field values or specific configuration changes, are generally not included in these logs.
Refer to "EventLogFile Supported Event Types" for a full list of trackable activities.
The time zone for the TIMESTAMP field in all Event Monitoring log files is UTC (GMT). This time zone setting cannot be changed.
https://help.salesforce.com/s/articleView?id=000396594&type=1
000396295

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.