Reference documentation for Audit Log fields

Fields

Highlighted and asterisked fields* are used for network policy logs, field audit logs, etc., and can have different meaning based on the context.

Note: Unless otherwise indicated, the attribute for a field is "Editable on Add or Update".

Field	Attribute	Description
record_id	Read Only	Record Id for this Audit Log entry This field acts as primary key for this table A new unique id is generated for every record inserted in this table
reference_id		Record Id of the record being logged This can be used to fetch more details about the record
type	Read Only	Description of the Log Code
type_code		Code indicating type of log activity, see Log Codes for more information User can optionally search the type by type_code
operation	Read Only	Description of the Operation Code
operation_code		Code indicating type of operation, see Operation Codes for more information User can optionally search the operation by operation_code
description	Read Only	Description of the action
description_key		Token for the description, which is used in search actions
object_key		Token for the object, which is used in search actions
old_name		Previous field name, for example: name in System Objects or field_name in Objects
new_name		New field name, for example: name in System Objects or field_name in Objects
date_created	Read Only	Date the activity is logged
owner_id	Read Only	Record owner identifier
date_col1*	Read Only	Start date of policy
date_col2*	Read Only	End date policy
int_col1*	Read Only	Status code for policy execution
int_col3*	Read Only	Access violations entry in Audit Log, contains the -1 value
char_col1*	Read Only	Field Id
object*	Read Only	Generic fields used to log specific information, Object Type Identifier in most cases Status for policy execution Note: This is not a searchable field, use object_key instead to search by object
char_col3*	Read Only	User Id
char_col4*	Read Only	Name of the record which is being accessed or a Search String in a Search action

Audit Log for Scheduled Activities

Field	Description
reference_id	policy_id
description	detailed description
date_col1	start date of activity
date_col2	end date of activity
char_col1	status message
object	object_id (Object Type Identifier)
char_col3	user_id
int_col1	status code 1 - started 2 - completed 3 - completed with errors 4 - unable to schedule

Field Audit Log

Field	Description
reference_id	stores record_id (Record Id)
description	Field status messages
type	61, see Log Codes
operation	Log Type: 1, 2, 3
char_col1	field_id(s)
object	object_id (Object Type Identifier)
old_name	Previous field name, for example: name in System Objects or field_name in Objects
new_name	New field name, for example: name in System Objects or field_name in Objects
ownerid	Record owner identifier

Access Violation

int_col3: To identify the access violations entry in Audit Log, this field contains the -1 value

Picklist Items

char_col1:Id of the Picklist for which the Picklist Item is being maintained

Application Role Workspace Preferences

char_col1:Role Id for specific tab applicationrole tab preference which is of type 64

Tab Access

object_singular_name:Object Id (Object Type Identifier)

Record Access

reference_id:Record Id (Record Id) of the record being accessed

object:Object Id (Object Type Identifier) of the record

char_col4 - Name of the record being accessed

Search

object_singular_name:Object Id (Object Type Identifier) of the searched object

char_col4:Search string

Governance Log

When global Service Configuration code-execution limits ("Develop Configuration") or tenant-specific limits ("Java Code Governors") are exceeded, an audit log entry is generated.

Field	Description
user_name	Login User Name of user who caused the limit to be exceeded
user_id	User's ID
type	Governance Threshold Violation
type_code	137, see Log Codes
operation	Data Policy - Invoke Method Controller Page Job Scheduler REST - Class Execution
operation_code	1 - Data Policy - Invoke Method 2 - Controller 3 - Page 4 - Job Scheduler 5 - REST - Class Execution
description	Name of the Class or Page and a Threshold Violation Message
reference_id	Record Id for "Data Policy - Invoke Method" Class name or Page name for other Threshold violations

Example - Search Contacts

Search the Contact object for search string "Test". The following entry is logged (NETWORK_LOG).

reference_id	type	operation	description	object_singular_name	char_col4
-1	66	1	Search Contacts for "Test"	CONTACT	TEST

Example - Search All

Search all objects for the search string "Test". The following entry is logged (NETWORK_LOG).

reference_id	type	operation	description	object_singular_name	char_col4
-1	66	1	Search all objects for "Test"		TEST

Log Codes

type_code	type	User documentation related to this platform element
1	Account	Accounts
2	Contact	Contacts
3 - 6	Unused
7	Ownership	Record Owners
8 - 9	Unused
10	Report	Reports
11 - 12	Unused
14	Billing Plan
16	Documents	Documents
19	Roles	Roles
20	Team	Teams
21	Link User to Team and Role	Manage Users
22	User	Users
24	Team Ownership Operation	Teams
25	Login/Logout	Login/Logout
26	Custom Field	Fields
27	Marketing Campaign	Campaigns
28	unused
29	Merge	Merge Records
30	Policy Management	Data Sharing Policies
31	Data Policy	Data Policy
32	Project Management	Projects
33	Project Member Manage
34	Project Milestone Manage
35	Project Partner Manage
36	Import Data	Import Data
40	Picklist Dependencies	Dependent Picklist
48	Custom Forms	Forms
49	Custom Objects	Custom Object
50	Custom Layouts	Forms
51	Password Policy	Password Policies
52	Custom Object Data	Objects
53	unused
54	Team Resource Sharing Policies
55	Mass Data Operation	Mass Operations
56	View/Report	Views/Reports
57	Product	Products
58	Price Book	Price Books
59	Service Provider Settings	Service Provider Settings
60	Scheduled Policies
61	Field Audit Trail	Field Audit Log
62	Global Picklists	Global Picklists
63	Picklist Items
64	Application Role Workspace Preferences	Workspace Display Order for objects in applications
65	Application Role View Preferences	Default View Preferences for objects in applications Application_Information Settings for tabs
66	Search	Search
67	View	View
68	Access Violation	Access violations are logged when Enhanced Security Audit is enabled
69	Tab
70 - 71	unused
72	Web Tab	Web Tabs
73	Components	Components
74	Custom Action	Actions
75	Document Folder	Folders
76	unused
77	Workflow	Workflows
78	Workflow State	States and Actions
79	Workflow Action	States and Actions
80	Print Template	Print Templates
81	Personalize	Personalize
82	Theme	Theme
83	Workspace Preference	Workspace Preference
84	External Email	External Email Tracking
85	Workflow Template	Workflow Templates
86	Layout Section	Section
87	Related Information	Related Information
88	Related Information Button
89	Quick Link	Quick Link
90	Recycle Bin	Recycle Bin
91	Request Update Settings	Request Update Settings
92	Outlook Sync	Outlook Sync
93	Outlook Email Edition	Outlook Email Edition
94	Application	Applications
95	Page	Pages
97	Class	Classes
98	Static Resource	Static Resources
99	Debug Log	Debug Log
100	Global Broadcast	Global Broadcast Message
101	View Management	Views and Reports
102	Export Data	Export Data
103	Company Message	Company Messages
104	Company Information	Company Information
105	Web Form	Web Forms
106	Package	Packages
107	Audit Log	Audit Log
108	Versioning	Versioning
111	Tag	Tagging
112	Report Folder
113	Data Validation	Data Validation
114	Layout Rule	Layout Rules
115	Database View	Database View
116	Package Item	Package Items
117	Indexes	Indexes
118	Record Locators	Record Locators
120	Notes	Notes
121	Attachments	Attachments
122	Media
123	Folder Templates
124	Scratch Pad
137	Governance Threshold Violation	Develop Configuration, Java Code Governors

Operation Codes

The following operation codes can be returned, and apply to all Log Code Types

operation_code	operation
0	View
1	Add
2	Update
3	Delete
1001	View Access Violation
1002	Add Access Violation
1003	Update Access Violation
1004	Delete Access Violation