How to access and download your Event Monitoring log files
Trailblazer Community

How to access and download your Event Monitoring log files

Spring 19

Last updated 2021-05-03 ·Reference W-6174124 ·Reported By 16 users

In Review

Summary
This article is to help you download logs to audit user activity or utilize Event Monitoring to download an audit trail describing the details of user activity in your organization. We refer to these user activities as events and store the details in event log files. You can extract the event log files to view information about individual events or track trends in events to swiftly identify abnormal behavior patterns.

To access and download event log files, authorized users will need the following permissions: View Event Log Files and API Enabled. Users with the View All Data permission can also view event monitoring data.

The Heroku Event Log File Browser application is the most straightforward approach to downloading your organization’s event monitoring data. This free application is easy to use and accessible via web browser. Use these simple instructions

* Log in to your organization.
* Navigate to the Event Log File Browser application (https://salesforce-elf.herokuapp.com/).
* Click Production Login.
* Set start Date 05/17 as our systems runs in UTC
* Select an event type for your search, or leave event type set to All.
* Choose Interval value of Daily.
* Click Apply.

Here's a demo video (https://sfdc.co/EventLogFileBrowserDemo) that shows how to extract event log files using the event log file browser.

We recommend reviewing this Event Monitoring Trailhead (https://sfdc.co/EMTrailhead) module for a helpful overview of how to query, download and analyze the Event Log Files.

For further reference, review the Using Event Monitoring (https://sfdc.co/UsingEM) guide in the REST API Developer Guide and for a comprehensive list of the event types and their use cases refer to the Supported Event Types (https://sfdc.co/SupportedEventTypes) in the Event Log File object.

Guide to interpreting log data https://sfdc.co/clfxoU

For further support, please reach out to your Success Manager (SM) or comment on your open case.

Repro
Not Applicable

Workaround
See Summary

Updates
Q: Are different event log lines are generated for users running in Lightning UI vs Classic UI?

A: Yes. Classic UI logs are in URI event while Lightning logs are in four different log lines (LightningInteraction, LightningError, LightningPageView and LightningPerformance).

Any unreleased services, features, statuses, or dates referenced in this or other public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make their purchase decisions based upon features that are currently available.