Storing and Querying Log Data with Event Log Objects

The Event Log Object framework provides a structured way to access event data stored in Salesforce. Unlike Event Log Files, which present event data as downloadable CSV files, Event Log Objects allow users to query event logs directly using SOQL. This approach offers a more integrated and dynamic way to analyze security, performance, and user activity data within Salesforce.

Key Features of Event Log Objects

Query with SOQL: As of Spring ‘25, Event Log Objects support SOQL queries for retrieving log data.
Faster Access to Log Data: Logs become available with minimal delay (typically 25-45 minutes after an event occurs), allowing for faster incident detection.
Integration with CRM Analytics: Event Log Objects can be analyzed using Salesforce Direct, enabling real-time visualizations in CRM Analytics.
API Accessibility: Data can be accessed via Salesforce Platform APIs, allowing organizations to build custom event monitoring applications within the Lightning UI.
Automated Monitoring: Users can write advanced SOQL queries to filter and aggregate log data for insights on security, performance, and product usage.

Availability and Requirements

Editions: Available in Enterprise, Performance, and Unlimited Editions.
Interfaces: Supported in Salesforce Classic (not in all orgs) and Lightning Experience.
Access: Requires Salesforce Shield or the Salesforce Event Monitoring add-on.
Hyperforce Exclusive: This feature is only available to Hyperforce customers, with log data retained for up to 30 days.

Enabling Event Log Objects

To enable Event Log Objects, follow these steps in Setup:

In Setup, enter Permission in the Quick Find box.
Select Permission Sets.
Assign View Event Log Object Data to access all log objects.
Alternatively, assign Event Monitoring User to access all Event Monitoring data.

Querying Event Log Data

Event Log Objects provide valuable insights through SOQL queries, allowing organizations to track activity across security, application performance, and user engagement.

Sample Queries by Use Case

Security Analysis

Identify users exporting the most rows via reports:

sqlCopyEditSELECT UserIdentifier, SUM(RowCount) 
FROM ReportEventLog 
WHERE Origin='ReportExported' 
AND DAY_ONLY(Timestamp) > LAST_N_DAYS:10 
GROUP BY UserIdentifier 
ORDER BY SUM(RowCount) DESC

Application Performance Monitoring (APM)

Track unexpected Apex exceptions by category:

sqlCopyEditSELECT ExceptionCategory, COUNT(Timestamp) 
FROM ApexUnexpectedExcpEventLog 
WHERE DAY_ONLY(Timestamp) > LAST_N_DAYS:10 
GROUP BY ExceptionCategory 
ORDER BY COUNT(Timestamp) DESC

Product Intelligence

Determine the most loaded Lightning pages:

sqlCopyEditSELECT COUNT(Timestamp), PageUrl 
FROM LightningPageViewEventLog 
WHERE DAY_ONLY(Timestamp) > LAST_N_DAYS:10 
GROUP BY PageUrl 
ORDER BY COUNT(Timestamp) DESC

Key Considerations

Data Availability: Expect log data to be queryable within 25-45 minutes after the event is logged.
Query Limits: Only 15 days of log data can be queried at a time using the Timestamp column.
Government Cloud Restriction: Event Log Objects are not available in Government Cloud instances. If an org migrates, access to event log data may be lost.
Correlating Logs for Debugging: Use the Request Identifier field available in all Event Monitoring logs to trace transactions.

Available Event Log Objects

Salesforce provides a wide range of Event Log Objects, each designed to capture specific types of system events:

Security & Access Logs:
- LoginEventLog
- LoginAsEventLog
- TransactionSecurityEventLog
- InsufficientAccessEventLog
API & Integration Logs:
- RestApiEventLog
- SoapApiEventLog
- BulkApiEventLog
- ApexRestApiEventLog
- ApexSoapApiEventLog
- MetadataApiOpEventLog
Application Performance Logs:
- ApexExecutionEventLog
- ApexUnexpectedExcpEventLog
- AuraRequestEventLog
- LightningLoggerEventLog
- VisualforceRequestEventLog
User Interaction & Analytics Logs:
- ReportEventLog
- SearchEventLog
- SearchClickEventLog
- LightningPageViewEventLog
- AnalyticsChangeEventLog
- AnalyticsPerfEventLog
Other Notable Logs:
- PackageInstallEventLog
- ContentTransferEventLog
- AsyncReportRunEventLog
- SandboxStatusEventLog

Visualizing Log Data with CRM Analytics

Organizations can transform raw log data into actionable insights using Salesforce Direct in CRM Analytics. This enables users to:

Generate real-time dashboards for security monitoring.
Analyze API performance trends with visual reports.
Identify high-traffic Lightning pages and optimize user experience.

Best Practices for Event Log Objects

To maximize the value of Event Log Objects, follow these best practices:

Optimize Queries: Use indexed fields and filters to improve SOQL query performance.
Automate Log Analysis: Set up scheduled queries to detect security incidents or performance bottlenecks.
Leverage API Integrations: Use Salesforce APIs to pull log data into external monitoring tools.
Monitor Access & Retention: Remember that log data is only retained for 30 days.

By effectively leveraging Event Log Objects, organizations can enhance security monitoring, troubleshoot performance issues, and gain deeper insights into Salesforce activity.

For more details on Event Log Objects and their use cases, refer to the Salesforce Object Reference Guide.