How to Monitor Salesforce Logins and Events
Monitor Salesforce login history and event data: where to find failed logins, what the audit trail does and does not record, and what to review weekly.
Updated 2026-09-09
Security reviews and incident investigations both start in the same place: who logged in, from where, and what changed afterwards.
Salesforce spreads that across three features, and knowing which one holds which answer saves the first twenty minutes of every investigation.
The three sources
- Login History (Setup → Identity → Login History): logins, source IP, status, and login type. Retained for six months.
- Setup Audit Trail: configuration changes and who made them, for the last six months.
- Event Monitoring: detailed event log files including report exports and API calls - a separate licence in most editions.
Querying login history
Login History is a queryable object, which makes it far easier to filter than the Setup list view.
SELECT UserId, LoginTime, SourceIp, Status, LoginType
FROM LoginHistory
WHERE LoginTime = LAST_N_DAYS:7 AND Status != 'Success'
ORDER BY LoginTime DESCA weekly review that takes ten minutes
- Failed logins clustered on one user or one IP range.
- Logins from countries the business does not operate in.
- New API-type logins, which usually mean a new integration nobody announced.
- Setup Audit Trail entries for profile, permission set, and sharing changes.
Watching it from the org you are in
TurboKit's event monitor surfaces login and event data alongside the org you are already working in, which keeps the weekly review from becoming a project.
Frequently asked questions
- How long does Salesforce keep login history?
- Login History is retained for six months in the UI and via the API. Longer retention requires exporting it or using Event Monitoring log files.
- Does the Setup Audit Trail show data changes?
- No - only configuration changes. Data changes need Field History Tracking or Field Audit Trail.
- Do I need Event Monitoring to investigate an incident?
- Not always. Login History plus the Setup Audit Trail answers most access questions. Event Monitoring adds report exports, API call detail, and page views, which matter for data-exfiltration questions.
More from the Admin How-To
- How to Check Salesforce Org LimitsCheck Salesforce org limits - API calls, data storage, file storage, and daily email - from Setup, the limits API, and the browser, before you hit them.
- Change Sets vs Metadata API Deployments: Which to UseChange sets and Metadata API / CLI deployments solve the same problem differently. Here is when each one is the right choice, and what a change set genuinely cannot do.
- How to Check Field-Level Security in Salesforce FastCheck field-level security in Salesforce without clicking through Setup: where FLS lives, how it interacts with profiles and permission sets, and faster ways to read it.
- How to Compare Two Profiles in SalesforceCompare two Salesforce profiles field by field: the native Setup route, the permission types worth diffing, and how to keep the result auditable.
- How to Create and Deploy a Salesforce Change SetStep by step: create an outbound change set, upload it, and deploy it as an inbound change set - plus the deployment connection you need between orgs before any of it works.
- How to Create Multiple Custom Fields in Salesforce QuicklyCreate custom fields in Salesforce in bulk - the Setup wizard, metadata deployment, and in-browser field creation - plus the naming rules to settle first.