Analyze runtime activity with Event Monitoring
Load Salesforce Event Monitoring log files for an org to see Apex transactions, CPU time, exceptions, slow triggers, callouts and logins over the last few days.
Overview
The Event Monitoring Dashboard turns Salesforce's Event Log Files into a readable picture of how an org behaves at runtime: how many Apex transactions ran, how much CPU they used, which exceptions occur most, which triggers and operations are slowest, which external endpoints you call, and how many logins there were.
Data is read live from Salesforce each time you load it. Nothing has to be synced first.
Before you start
- The org needs Salesforce Event Monitoring — a Salesforce add-on license (included in Salesforce Shield). Without it, Salesforce does not produce the log files this page reads.
- The Salesforce user behind the connection needs the View Event Log Files permission.
- The org connection must be working.
Steps
- Open Event Monitoring under Monitoring, Runtime & Logs.
- Pick the org.
- Pick a period: Last 3 days, Last 7 days (the default), Last 14 days or Last 30 days.
- Click Load Event Data. The first request for an org takes about 20–30 seconds; large orgs can take up to 90 seconds. Later loads within a few minutes are faster.
- Read the cards: Apex Transactions, Avg CPU Time, Exceptions, Trigger Executions, Total Callouts and Total Logins.
- Review Daily Activity Trend to spot unusual days.
- Review Exception Types, Top Slowest Operations (avg CPU), Slowest Triggers (avg exec time) and Top Callout Endpoints.
- To reload with fresh data, click Refresh.
Example
Priya, a release manager, loads the last 7 days for acme-prod after users report slowness. Daily Activity Trend shows CPU time climbing from Tuesday. Slowest Triggers (avg exec time) lists the Opportunity trigger at the top, and Exception Types shows a jump in limit exceptions on the same day — the day a new release went out. She opens Apex Flow Analyzer to trace that trigger's execution path.
FAQs
Why does it say "N of M log files sampled"?
On busy orgs there are too many log files to download in one request, so the page analyzes a sample and labels affected figures as a sampled portion. Use a shorter period for a complete picture.
Is this the same as Runtime Forensics?
No. Runtime Forensics looks at async Apex job failures. Event Monitoring covers all runtime activity recorded in event log files, including synchronous transactions, callouts and logins.
Does MetaLens360 store event data?
The page reads event log files from Salesforce when you load it, so the numbers reflect Salesforce's own retention for those files.
Troubleshooting
"Event Monitoring is not enabled for this org…"
The org lacks the Event Monitoring license, or the connected user lacks the View Event Log Files permission. Enable it in Setup → Event Monitoring, or ask your Salesforce admin to grant the permission.
"Request timed out. Try a shorter date range (3 days)…"
Large orgs produce a lot of log data. Choose Last 3 days and try again — the second attempt is faster.
"Salesforce session expired. Go to Connections → Test on this org to re-authenticate, then retry."
Open Connections, test the org's connection (reconnect it if needed), then load the data again.
Related articles
Was this article helpful?
Related articles
- Investigate async Apex failures with Runtime ForensicsPull failed batch, queueable, future and scheduled Apex jobs from an org, grouped by root cause, with a daily trend, the classes involved and where to look for each cause.
- Fetch and analyze Apex debug logsFetch Apex debug logs from an org with server-side filters, then parse a log into governor-limit usage, SOQL statements, exceptions and the busiest methods.
- Watch Salesforce org limits with Platform Limits HealthTrack Salesforce org limits such as API calls and storage over time, see which are critical or trending to exhaustion, compare orgs, and get a daily digest email when a limit is at risk.
- Fix expired org credentialsWhen an org shows Reconnect needed, Salesforce has refused its stored credentials. Re-credential it in place from the Edit dialog without losing any synced data.