Salesforce now allows you to keep Event Monitoring Logs for a year [UPDATED — 25 June 2024]
The Event Monitoring product is an amazing one from Salesforce as it allows you to see exactly what is going on inside your Salesforce org as well as proactively protecting your data! I am writing another blog about that which will be out soon!
Event Monitoring will show you every record that a user has seen — either by going to the record itself, or the record was on a list view the user viewed, or that the record was in a report that the user previewed, ran, exported or was delivered by the Scheduled Report capability, or that the record was exported via the API by the user, or that they clicked on the record in a global search result.
Event Monitoring is also be very useful for seeing “business as usual” things which you cannot easily see in other ways — that there was an uncaught exception in the Apex Code running in the system or a user tried to access a record when they did not have access rights to.
The EventLogFile events (over 60 event types) are a pain to access as they are a CSV (or TSV) file stored as a BASE64 encoded blob in a field on the EventLogFile record — and they are only kept for 30 days. The accessing of these files in the Summer 24 release has been massively improved with the inclusion of the Event Log File Browser.
Whereas the Real Time Events are stored in their own objects and can be accessed using standard SOQL — all of these are stored for, at least, 180 days. IdentityVerificationEvent and LoginEvent are stored for 10 years.
Now (as of Summer 24 release : June 2024), Salesforce has allowed admins of orgs with Event Monitoring to enable storage of all these logs for 365 days. All you need to do is check the box!
UPDATE: 25 June 2024 — only the EventLogFile events are able to be stored for 365 days. Real Time Events are as they were.
If you do not check the box, then the standard storage for your events will remain.
There is a way to change the setting to be less than 1 year if you would like — this can only be done via the Salesforce Metadata API and involves setting the eventLogRetentionDuration value in the Events section of the Settings metadata. The Salesforce documentation does not currently (June 22, 2024) explain what this is, however this has been raised and will be corrected.
