description: 'Login events contain details about your org’s user login history.'
description: The type of event. The value is always Login.
description: 'The access time of Salesforce services in GMT. For example: 20130715233322.670.'
The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID. For example: 3nWgxWbDKWWDIk0FKfF5DV.
description: 'The 15-character ID of the organization. For example: 00D000000000123.'
The 15-character ID of the user who’s using Salesforce services through the UI or the API. For example: 00530000009M943
description: The amount of time that the request took in milliseconds.
The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer.
description: 'The URI of the page that’s receiving the request. For example: /home/home.jsp.'
The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started. For Login Event Type, this field is usually null because the event is captured before a session is created. Example d7DEq/ANa7nNZZVD
The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring. For example: GeJCsym5eyvtEK2I.
The status of the request for a page view or user interface action. Possible values are:
S—Success. Salesforce handled the request successfully. If an Apex controller throws an exception, this status is also returned.
F—Failure. Typically 4xx or 5xx HTTP codes, such as no permission to view page, page took too long to render, page is read-only.
R—Redirect. Typically a 3xx HTTP code, possibly initiated by an Apex controller in a Visualforce page.
The time in nanoseconds for a database round trip. Includes time spent in the JDBC driver, network to the database, and DB_CPU_TIME. Compare this field to CPU_TIME to determine whether performance issues are occurring in the database layer or in your own code.
The identifier string returned by the browser used at login. Example values are:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv%3A50.0) Gecko/20100101 Firefox/50.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36
The type of API request. Possible values are:
description: 'The version of the API that’s being used. For example: 36.0.'
description: The username that’s used for login.
description: 'The TLS protocol used for the login. There are 3 possible values: 1.0, 1.1, 1.2'
The TLS cipher suite used for the login. Values are OpenSSL-style cipher suite names, with hyphen delimiters. For more information, see OpenSSL Cryptography and SSL/TLS Toolkit.
- name: TIMESTAMP_DERIVED
The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ). For example: 2015-07-27T11:32:59.555Z. Timezone is GMT.
The 18-character case insensitive ID of the user who’s using Salesforce services through the UI or the API. For example: 00590000000I1SNIA0.
The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from Salesforce Workbench or AppExchange) is shown as "Salesforce.com IP". For example: 10.0.0.1.
description: The 18-character case insensitive ID of the URI of the page that’s receiving the request.
The status of the login attempt. For successful logins, the value is LOGIN_NO_ERROR. All other values indicate errors or authentication issues. For details, see https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_eventlogfile_login_status.htm
description: The source IP of the login request.
- name: AUTHENTICATION_METHOD_REFERENCE
The authentication method used by a third-party identification provider for an OpenID Connect single sign-on protocol. This field is available in API version 51.0 and later.
The category of user license. Possible values are:
CsnOnly — Users whose access to the application is limited to Chatter. This user type includes Chatter Free and Chatter moderator users.
CspLitePortal — CSP Lite Portal license. Users whose access is limited because they’re organization customers and access the application through a customer portal or an Experience Cloud site.
CustomerSuccess — Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal.
Guest — Users whose access is limited so that your customers can view and interact with your site without logging in.
PowerCustomerSuccess — Power Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal. Users with this license type can view and edit data they directly own or data owned by or shared with users below them in the customer portal role hierarchy.
PowerPartner — Power Partner license. Users whose access is limited because they’re partners and typically access the application through a partner portal or site.
SelfService — Users whose access is limited because they’re organization customers and access the application through a self-service portal.
Standard — Standard user license. This user type also includes Salesforce Platform and Salesforce Platform One user licenses, and admins for this org.