Salesforce Event Logs

Capture detailed information about user activities, system operations, and performance metrics within a Salesforce organization.

Setup

Salesforce Event Logs supports API polling to collect event logs from your Salesforce organization using OAuth 2.0 client credentials. The setup steps are the same as for Salesforce Audit Trail; you can use the same Connected App credentials for both Event Logs and Audit Trail if you want to run both sources.

Step 1: Create the External Client App

1. In Salesforce, go to Setup (click the gear icon)
2. In the Quick Find box, search for "External Client App Manager" (or go to Apps → External Client Apps → External Client App Manager in the sidebar)
3. Click "New External Client App" in the top right
4. Fill in the basic information:
   • Connected App Name: Your integration name (e.g. "RunReveal")
   • API Name: (auto-fills based on the name)
   • Contact Email: Your email

Step 2: Configure OAuth Settings

1. Check "Enable OAuth Settings"
2. Set Callback URL to: https://login.salesforce.com/services/oauth2/callback (or your specific callback URL if different)
3. Under Selected OAuth Scopes, add:
   • Perform requests at any time (refresh_token, offline_access)
   • Manage user data via APIs (api)
4. Check "Enable Client Credentials Flow"
5. Click "Create"

Step 3: Enable Client Credentials Flow

1. Edit the app you just created
2. Check "Enable Client Credentials Flow"
3. In the "Run As" field, search for and select the execution user

Step 4: Save and Retrieve Credentials

1. Click "Save"
2. Click "Continue" on the confirmation page
3. You'll see the Consumer Key displayed immediately
4. Click "Manage Consumer Details" to view the Consumer Secret
5. Salesforce will send a verification code to your email — enter it to proceed
6. Copy both the Consumer Key and Consumer Secret for use in RunReveal

Step 5: Connect in RunReveal

1. Go to Sources in RunReveal
2. Click the Salesforce Event Logs source tile
3. Give it a name and fill in the required fields:
   • Salesforce Instance Host: Your Salesforce instance URL (e.g. company.my.salesforce.com)
   • Client ID: The Consumer Key from Step 4
   • Client Secret: The Consumer Secret from Step 4
4. Click Connect Source

RunReveal will start polling within a minute and backfill the last 30 days on first sync. When new EventLogFiles show up still depends on Salesforce's generation delay (hours for Hourly, at least a day for Daily).

Video Walkthrough

Verify It's Working

The source starts polling within a minute. Event log files may not exist yet — see the delay above.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'salesforce' LIMIT 1

Troubleshooting

Missing event logs (or collection stopped)

If logs never appear, stop after working, or you see an error about Salesforce tables the user cannot see, the usual cause is the Run As user on the External Client App. Salesforce hides objects a user cannot read instead of returning a clear permission error. We did not need to change anything on our side for collection to stop — a profile, permission-set, or Run As user change on the Salesforce side is enough.

Confirm that user's profile (or permission sets) still includes:

Assigning the Event Monitoring Analytics license or permission set is not enough. Those grant the prebuilt CRM Analytics app, not EventLogFile.

If collection worked previously, check in this order:

1. The External Client App's Client Credentials Flow → Run As user was reassigned.
2. That user's profile, permission sets, or user license changed (including losing View Event Log Files or View All Data).

Event logs appear hours or a day late

That is Salesforce generating EventLogFiles, not a RunReveal outage. Hourly files typically take 3–6 hours. Daily files are unavailable for at least 1 day. See the polling callout above. If your org does not have the hourly Event Monitoring add-on, keep Polling Interval on Daily.

sObject type 'EventLogFile' is not supported

Salesforce returns this INVALID_TYPE error when the Run As user cannot read the EventLogFile object. The wording is misleading — the object has existed since API version 32.0 and has not been removed. A missing permission and a nonexistent object produce the same error.

Grant View Event Log Files, View All Data, and API Enabled, as described above and in Step 3.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Related Documentation

• Using Event Monitoring — Salesforce's EventLogFile delays (hourly 3–6 hours, daily at least 1 day)
• Query or View Hourly Event Log Files — Hourly EventLogFile generation and caveats
• Salesforce AuditTrail — Setup audit log source; same Connected App can feed both