Emma Johnson, a Salesforce Administrator at Gurukul on Cloud (GoC), was recently approached by the InfoSec team to investigate suspicious login activity flagged during an external audit. However, she quickly realized that the default 30-day event log retention was insufficient to analyze long-term user behavior. To address this, Emma and the InfoSec team agreed to explore how to extend the retention of Event Log Files to at least one year.

Automation Champion Approach (I-do):

Event Log Files in Salesforce are part of Event Monitoring, a feature that provides detailed logs of user activity and system performance across your Salesforce org. These logs capture events such as:

• Logins and logouts
• API calls
• Report exports
• Data changes
• Apex executions
• Lightning page views
• Check EventLogFile for supported event types

Each event is recorded in a log file (in CSV format), which admins and security teams can download and analyze for insights.

Advantages of Event Log Files

Retaining and analyzing Event Log Files gives Salesforce admins, developers, and security teams powerful insights into how their org is used. From boosting security to optimizing performance and ensuring compliance, Event Log Files offer a proactive way to monitor, manage, and improve your Salesforce environment. Below are five key advantages of using Event Log Files:

1. Enhanced Security Monitoring: Detect suspicious login activity, access from unknown IPs, and potential data breaches.
2. Compliance and Audit Readiness: Maintain detailed user activity logs to meet regulatory and audit requirements.
3. Performance Analysis: Identify slow-performing Apex code or Lightning components for optimization.
4. Data Loss Prevention (DLP): Track report exports and file downloads to prevent unauthorized data sharing.
5. User Behavior Insights: Analyze user interactions to improve adoption, training, and overall experience.

Step 1: Enable Extended Retention Period for Event Log Files

Assuming Event Monitoring is already enabled and you want to focus only on retaining Event Monitoring Event Log Files for up to one year, here’s the step-by-step guide:

1. Navigate to Setup | Security | Event Monitoring | Event Monitoring Settings.
2. Toggle on the Retain event log files setting.
3. To specify how long to retain event log data, set theeventLogRetentionDurationfield in theEventSettingsMetadata API.