It's an extremely rich data source, originally created by Salesforce developers to better understand the operational health of the overall service and better support our customers.
Extending access to these log files provides our customers the ability to support themselves using some of the same tools we've used to support them.
Most fields in the log files are self-describing like CLIENT_IP or TIMESTAMP. However, some of the log file fields can be difficult to understand without a lexicon.
There are a couple of reasons for this. One reason is because some fields are derived where data is encoded in an enumerated value or with an acronym which is defined in a separate place in the code.
A lot of time, this is done because less characters or numeric codes take up less total storage space which is important when you're storing terabytes of log files every day.
But this leaves us with a problem, what in the world does the data actually mean?
For instance, rather than store 'Partner' for the API_TYPE in the API log file, we store a simple code of 'P'.
Another example is when the code is spelled out and still needs interpretation. For instance, VersionRenditionDownload for the TRANSACTION_TYPE in the ContentTransfer log file simply means someone previewed a file in the app instead of downloading it (which is actually VersionDownloadAction or VersionDownloadApi).
All of this means we need a lexicon to map codes to possible values or examples so that we understand the data we're downloading.
Below are some example fields to help make sense of the data from Event Log Files.
Common Log File Fields
These are log fields you'll see across many different log files and typically address who, what, when, where, and how.
Field Name | Description | Possible Values or Examples (e.g.) |
CLIENT_IP | The IP address of the client using Salesforce services. | e.g. 192.168.0.1 |
EVENT_TYPE | The type of event, such as content sharing. | e.g. URI |
ORGANIZATION_ID | The 15-character ID of the organization. | e.g. 00DB00000000mZw |
REQUEST_ID | The unique ID of a single transaction. | e.g. 3nWgxWbDKWWDIk0FKfF5DV |
REQUEST_STATUS | The status of the request for a page view or user interface action. | Possible values include: • S: Success • F: Failure • U: Uninitialized |
TIMESTAMP | The access time of Salesforce services, in UTC time. | e.g. 20130715233322.670, which equals 2013-07-15T23:33:22.670+0000. |
URI | The URI of the page receiving the request. | e.g. /home/home.jsp |
USER_ID | The 15-character ID of the user using Salesforce services, whether through the UI or the API. | e.g. 005B00000018C2g |
Log File Specific Fields
These are log fields that are typically unique to one or two log files and typically represent a type, operation, or other enumerated value.
EventType (File Type) | Field Name | Description | Possible Values or Examples (e.g.) |
APEX_CALLOUT_EVENT | METHOD | The HTTP method of the callout. | e.g. GET, POST, PUT, DELETE |
APEX_CALLOUT_EVENT | TYPE | The type of callout | e.g. REST, AJAX |
APEX_TRIGGER_EVENT | TRIGGER_TYPE | The type of this trigger. | The types of triggers are: • AfterInsert • AfterUpdate • BeforeInsert • BeforeUpdate |
API_EVENT | METHOD_NAME | The API method that is invoked. | e.g. query(), insert(), upsert(), delete() |
API_EVENT | API_TYPE | The type of API invoked. | values include: • X: XmlRPC • O: Old SOAP • E: SOAP Enterprise • P: SOAP Partner • M: SOAP Metadata • I: SOAP Cross Instance • S: SOAP Apex • D: Apex Class • R: REST API • T: SOAP Tooling |
ASYNC_REPORT_EVENT | DISPLAY_TYPE | The report display type, indicating the run mode of the report. | Possible values include: • D: Dashboard • S: Show Details • H: Hide Details |
ASYNC_REPORT_EVENT | RENDERING_TYPE | The report rendering type, describing the format of the report output. | Possible values include: • W: Web (HTML) • E: Email • P: Printable • X: Excel • C: CSV (comma-separated values) • J: JSON (JavaScript object notation) |
CONTENT_DOCUMENT_LINK_EVENT | SHARING_OPERATION | The type of sharing operation on the document. | e.g. INSERT, UPDATE, or DELETE. |
CONTENT_DOCUMENT_LINK_EVENT | SHARING_PERMISSION | What permissions the document was shared with. | The possible values include: • V: Viewer • C: Collaborator • I: Inferred—that is, the sharing permissions were inferred from a relationship between the viewer and document. For example, a document’s owner has a sharing permission to the document itself. Or, a document can be a part of a content collection, and the viewer has sharing permissions to the collection, rather than explicit permissions to the document directly. |
CONTENT_TRANSFER_EVENT | TRANSACTION_TYPE | The operation performed. | The possible operations include: • VersionDownloadAction and VersionDownloadApi represent downloads via the user interface and API respectively. • VersionRenditionDownload represents a file preview action. • saveVersion represents a file being uploaded. |
DASHBOARD_EVENT | DASHBOARD_TYPE | The type of dashboard. | Valid types include: • R: Run as Running User • C: Run as Context User • S: Run as Specific User |
LOGOUT_EVENT | USER_INITIATED_LOGOUT | The user type used when logging out. | The value is 1 if the user intentionally logged out by clicking the Logout link, and 0 if they were logged out by a timeout or other implicit logout action. |
MDAPI_OPERATION_EVENT | OPERATION | The operation being performed | e.g. DEPLOY, RETRIEVE, LIST, DESCRIBE |
PACKAGE_INSTALL_EVENT | OPERATION_TYPE | The type of package operation. | Possible values include: • INSTALL • UPGRADE • EXPORT • UNINSTALL • VALIDATE_PACKAGE •INIT_EXPORT_PKG_CONTROLLER |
REPORT_EVENT | DISPLAY_TYPE | The report display type, indicating the run mode of the report. | Possible values include: • D: Dashboard • S: Show Details • H: Hide Details |
REPORT_EVENT | RENDERING_TYPE | The report rendering type, describing the format of the report output. | Possible values include: • W: Web (HTML) • E: Email • P: Printable • X: Excel • C: CSV (comma-separated values) • J: JSON (JavaScript object notation) |
REST_API_EVENT | METHOD | The HTTP method of the request | e.g. GET, POST, PUT, DELETE |
SITES_EVENT | HTTP_METHOD | The HTTP method of the request | GET, POST, PUT, DELETE |
SITES_EVENT | REQUEST_TYPE | The request type. | Possible values include: • page: a normal request for a page • content_UI: a content request for a page originated in the user interface • content_apex: a content request initiated by an Apex call • PDF_UI: a request for a page in PDF format through the user interface • PDF_apex: a request for PDF format by an Apex call (usually a Web Service call) |
UI_TRACKING_EVENT | CONNECTION_TYPE | Method used by the mobile device to connect to the web. | Values can include: • CDMA1x • CDMA • EDGE • EVDO0 • EVDOA • EVDOB • GPRS • HSDPA • HSUPA • HRPD • LTE • OFFLINE • WIFI |
VISUALFORCE_EVENT | REQUEST_TYPE | The request type. | Possible values include: • page: a normal request for a page • content_UI: a content request for a page originated in the user interface • content_apex: a content request initiated by an Apex call • PDF_UI: a request for a page in PDF format through the user interface • PDF_apex: a request for PDF format by an Apex call (usually a Web Service call) |
Hi Adam,
ReplyDeletehow do I access the event log file - Setup? Do I need an activiation from Salesforce Support?
Best regards,
Matthias
Hi Matthais,
DeleteIt's only available via the API and needs to be enabled for your org. However, if you have a developer edition org, it's already enabled there. I suggest logging in through workbench.developerforce.com and trying it out there.
Hi Adam,
ReplyDeleteGreat post! Thank you. We have recently enabled event monitoring in our org. We have faced Org Limit exceptions during run-time. We were wondering if you would know that is any information is stored in the log files regarding the exceptions?
Thanks,
Puneet
Also, there is a column NUMBER_SOQL_QUERIES in ApexExecution event log file where several rows have value greater than 100. What exactly does the column NUMBER_SOQL_QUERIES represent?
DeleteBest regards,
Puneet Mehta
Hi Puneet - We're looking into org limits as a use case. In the meantime, have you tried out the limits endpoint in REST (https://www.salesforce.com/us/developer/docs/api_rest/Content/dome_limits.htm)? This will provide a subset of org limits.
DeleteIt should represent the number of SOQL queries across the entire Apex Transaction.
DeleteHi Adam, Thank you for your response. Yes, the org limits are our primary concern. Are any exceptions logged in the log files? Yes, we have tried the Limit resource of REST API. We make an hourly call and store the result in a object with fields as Limit Name, Max, Remaining and have created reports on it. (https://success.salesforce.com/06930000004jktA) (https://success.salesforce.com/06930000004jksv)
DeleteEntire transaction? One of the row has value as 24236. How can it be greater than 100? Also, the data for RUN_TIME column is missing in ApexCallout and ApexTrigger.
DeleteWe are fixing the RUN_TIME column in ApexCallout in the Summer '15 release due in June. Still looking into Trigger.
DeleteOnce you have a REQUEST_ID from an event log file, how can you get more details on that transaction? Eg, a "RestAPI" event log includes "NUMBER_FIELDS", but not the names of the fields or the actual query. I realize this may not be in the event logs themselves, so curious what other data source this would be joined with to extract additional details.
ReplyDeleteThanks,
Bill
Hi Bill,
DeleteI know we're discussing this in a separate thread but for everyone else's edification, we do share query string information on the API log for any queries in the Tooling API. We're looking at what it would take to extend that to the other APIs like SOAP and REST.
I've had many requests to provide the full Event Log File schema. We're planning on adding it to the online documentation but in the meantime, you can download it from my Github repo: http://bit.ly/elfEventTypes
ReplyDeleteWould it be possible to get the complete Event Log File schema in a text format like CSV, JSON, XML, HTML?
DeleteAlso, is there a complete list of EVENT_TYPE values?
DeleteHi @Yoway,
DeleteThe list of 28 types is in the schema doc (http://bit.ly/elfEventTypes) that will be incorporated into the online salesforce docs in June.
You can also get the schema from using SOQL to query the following fields on the EventLogFile sObject:
SELECT EventType,LogFileFieldNames,LogFileFieldTypes FROM EventLogFile
Hope this helps.
Thanks!
AT
Hello,
ReplyDeleteIn Event Log File -> Report, the report ids which are fetched are that of reports in "My Personal Custom Folder" of the users. For such report ids, we can't fetch the corresponding metadata (Report name etc) even if this information is sought by the system administrator. Is there any other way of getting this information?
Also, the standard report information (id or name) is missing form Reports. so it is not possible to figure out which report has been run.
Any pointers? Thanks!
Not really beyond logging in as a user to get the report metadata. The best bet is to work directly with the user who ran the report (and by proxy owns the folder). Unfortunately this is a known idea exchange posting: https://success.salesforce.com/ideaview?id=08730000000BrZAAA0
DeleteHi Adam,
ReplyDeleteIn Content Transfer file, we are getting some userids which does not exist in Salesforce, the file preview type is Paged_flash. Do you know what is this preview type and how we can get the user details.
Many Thanks
We've gotten some PAGED_FLASH previews of a word (WORD_X) document. The same document was previewed by the same user at much smaller footprint (THUMB120BY90). Is the Paged_Flash version a file previewed at full screen?
ReplyDelete