Auditing and Monitoring
Where to look
Four tools answer most audit questions. Setup Audit Trail records configuration changes - who edited a profile, deployed a change set, changed a sharing rule - for the last 180 days (the page shows the 20 most recent; download for the full history). Field History Tracking records value changes on up to 20 fields per object, retained for a limited window (roughly 18 months; extend with Field Audit Trail under Shield). Login History shows the last 20,000 authentication attempts over six months, including IP, login type, and status. Event Monitoring (Shield) captures granular activity such as API calls, list views, and report exports.
Also know Health Check and Security Health Check for org baselines, debug logs and Apex exception emails, email log files, the Lightning Usage App, and reports over sessions and API usage.
Traps
- The Setup Audit Trail does not show data changes, record deletions, or failed logins - field history, the Recycle Bin, and Login History do.
- Audit Trail entries age out at 180 days; if a question implies a longer lookback, the answer is Field Audit Trail or event log files.
- Field history is not retroactive: it records only from the moment it is enabled.
- 'Who deleted this record?' is answered by the Recycle Bin (15 days) or a report, not by field history.
Worked example
A field vanished from a page layout. Search the Setup Audit Trail for the layout name, sort by date, and read the delegate - that gives person and timestamp in one step. Determining when values in that field changed is a different question and requires field history to have been enabled beforehand.