Skip to main content
ComponentsEngineMobile AppRUM ExtRUM JS
Availability2017.1 or later

What Audit Monitoring Provides

Track Salesforce configuration changes

Disable Audit Monitoring

Stop collection, keep records

Configure Alerts

Alert only on critical changes

Security and Retention

Protect and retain sensitive records

​
Overview

GermainUX collects Salesforce audit information to help teams identify administrative and configuration changes that may affect security, performance, reliability, or user experience. Audit Monitoring helps answer:
  • Question
  • What changed in Salesforce?
  • Who made the change?
  • When did it occur?
  • Which Salesforce environment was affected?
  • Did the change coincide with a new error or performance regression?
  • Did it affect user access, workflows, integrations, or application behavior?
Audit Monitoring is performed by the GermainUX Engine and is enabled automatically when Salesforce monitoring is deployed through the Salesforce Application wizard.

​
What Audit Monitoring Provides

Depending on the audit information available through Salesforce and the permissions granted to the integration user, GermainUX can monitor changes related to:
  • Area
  • Salesforce configuration
  • Users, profiles, permission sets, and access
  • Connected Apps and authentication settings
  • Objects and fields
  • Workflows, flows, and automation
  • Apex classes and triggers
  • Lightning and Visualforce configuration
  • Reports and dashboards
  • Sharing and security settings
  • API and integration configuration
  • Other administrative changes recorded by Salesforce
Each audit record may include available attributes such as:
  • Attribute
  • Change timestamp
  • User or administrator
  • Action
  • Configuration area
  • Description
  • Salesforce organization
  • Environment
  • Related object or component

​
Prerequisites

Before configuring Audit Monitoring, confirm that:
  • A GermainUX Engine is deployed and running.
  • Salesforce monitoring has been deployed through the Salesforce Application wizard.
  • The Salesforce OAuth connection is active.
  • The integration user can access the required Salesforce audit information.
  • The selected GermainUX Engine can reach Salesforce APIs.
  • The Salesforce organization has sufficient API capacity for the selected collection frequency.
For the initial integration, see Deploy GermainUX for Salesforce.

​
Enable Audit Monitoring

Audit Monitoring is enabled automatically during the initial Salesforce Application wizard deployment. To deploy it:
1

Open GermainUX Workspace

2

Open the left navigation menu

3

Select Wizards

4

Select Salesforce Application

5

Choose the GermainUX Engine that will monitor Salesforce

6

Enter the Salesforce connection and authentication settings

7

Expand Show Advanced if you want to customize the audit collection interval

8

Set Audit Monitoring Interval

9

Complete the wizard

The wizard creates a component with this type:

​
Default Collection Frequency

By default, Salesforce Audit Monitoring runs every 12 hours. This schedule is appropriate for general configuration-change tracking. Use a shorter interval when faster detection is required, while considering:
  • Consideration
  • Salesforce API consumption
  • Number of monitored organizations
  • Audit-event volume
  • Required alerting speed
  • GermainUX processing and storage
For immediate security or activity detection, Salesforce Real-Time Event Monitoring may also be required because scheduled audit collection is not designed as a real-time security feed.

​
Configure the Frequency During Deployment

During the initial Salesforce Application wizard:
  1. Select Show Advanced.
  2. Locate Audit Monitoring Interval.
  3. Enter the required frequency.
    Execution Schedule configuration for SFDC Instance Status component
  4. Complete the wizard.
    Audit Monitoring Interval

​
Change the Frequency After Deployment

To update the schedule of an existing audit monitor:
  1. Open GermainUX Workspace.
  2. Open the left navigation menu.
  3. Select Germain.
  4. Open the State tab.
  5. Search for: Type Name = Salesforce Audit Monitor
    Salesforce Audit Monitoring component

    Salesforce Audit Monitoring component

  6. Select the monitor associated with the intended Salesforce organization.
  7. Update Execution Schedule.
  8. Save the change.
The revised schedule applies to subsequent executions.

​
Disable Audit Monitoring

To stop ongoing collection without removing the entire Salesforce integration:
1

Open GermainUX Workspace

2

Open the left navigation menu

3

Select Germain

4

Open the State tab

5

Search for: Type Name = Salesforce Audit Monitor

6

Locate the appropriate monitor

7

Turn off the toggle in the Enabled column

8

Save the change if prompted

Disabling the monitor stops future collection. Previously collected audit records remain available according to the applicable GermainUX retention policy.

​
Re-enable Audit Monitoring

To resume collection:
1

Return to Germain → State

2

Search for Salesforce Audit Monitor

3

Turn on the Enabled toggle

4

Confirm the execution schedule

5

Save the configuration

6

Allow the next scheduled execution to run

​
View Salesforce Audit Data

Open:
DashboardsITApplicationSalesforceSalesforce
Review the portlets related to Audit. The dashboard can help analyze:
  • Analysis
  • Recent Salesforce changes
  • Changes by administrator
  • Change categories
  • Affected components
  • Change frequency
  • Changes by organization or environment
  • Configuration activity preceding an issue
Select an audit metric or record to open its details and related evidence.

​
Salesforce Audit KPIs

See Salesforce Audit KPIs. These KPIs can be used to:
  • KPI
  • Count configuration changes
  • Track trends
  • Segment changes by administrator or category
  • Identify unusual administrative activity
  • Compare environments
  • Correlate changes with application regressions

​
Correlate Changes With Salesforce Issues

Audit data becomes particularly useful when analyzed alongside other Salesforce telemetry. For example:
  1. Salesforce response time degrades.
  2. GermainUX identifies when the degradation began.
  3. Audit records show that a Flow, Apex class, permission, or integration setting changed shortly beforehand.
  4. Related errors, debug logs, user sessions, and Session Replay provide additional evidence.
  5. The team confirms whether the change caused or contributed to the regression.
Audit records can be correlated with:
  • Apex exceptions
  • Debug logs
  • Salesforce errors
  • API and integration failures
  • User-facing errors
  • Slow interactions
  • Failed workflows
  • Session Replay
  • Salesforce deployments
  • Instance-status events
A temporal correlation is evidence for investigation, but it does not by itself prove causation.

​
Configure Alerts

Create alerts for audit activity that requires timely review. Useful alert conditions include:
  • A critical Salesforce configuration changes.
  • A high-risk security setting changes.
  • A Connected App or OAuth configuration changes.
  • A user, profile, or permission changes unexpectedly.
  • Multiple administrative changes occur within a short period.
  • A change occurs outside an approved maintenance window.
  • A new performance or error regression follows a configuration change.
  • An unauthorized or unexpected administrator performs a change.
Alert recipients may include:
  • Salesforce administrators
  • Security teams
  • Application owners
  • Operations teams
  • Change-management teams
Avoid generating an alert for every routine change. Categorize and prioritize changes according to their operational and security significance.

​
Validate Audit Monitoring

After the first scheduled execution, verify that:
  • Salesforce Audit Monitor is enabled.
  • Its last execution completed successfully.
  • Its next execution matches the configured schedule.
  • Audit records appear in the Salesforce dashboard.
  • The correct organization and environment are assigned.
  • Timestamps and administrator identities are accurate.
  • Expected configuration changes are present.
  • Details are sufficient for investigation.
  • Alerts fire only for the intended conditions.
For controlled validation:
1

Make a harmless, approved configuration change in a non-production Salesforce environment

2

Wait for the next monitor execution

3

Confirm that the change appears in GermainUX

4

Verify its user, timestamp, action, and organization

5

Reverse the test change if appropriate

​
No Audit Data Appears

If the monitor runs but no audit records appear:
1

Confirm that the correct Salesforce organization is configured

2

Verify the OAuth connection

3

Confirm that the integration user can access Salesforce audit information

4

Check that Salesforce Audit Monitor is enabled

5

Review its last execution and next scheduled execution

6

Confirm that the selected GermainUX Engine is running

7

Check connectivity from the Engine to Salesforce

8

Review Engine logs for authentication, authorization, API, and parsing errors

9

Check Salesforce API usage and limits

10

Confirm that audit records exist for the selected time range

11

Verify dashboard filters, organization, environment, and timezone

​
Audit Data Is Delayed

Audit Monitoring is scheduled rather than instantaneous. If records arrive later than required:
1

Review the current Execution Schedule

2

Confirm that recent executions completed successfully

3

Reduce the interval if faster collection is operationally justified

4

Review the effect on Salesforce API consumption

5

Consider Real-Time Event Monitoring for use cases requiring immediate detection

​
Security and Retention

Audit records can contain sensitive information about:
  • Administrators
  • Security configuration
  • Permissions
  • Connected Apps
  • Internal components
  • Integration endpoints
  • Organizational changes
Before production use:
  • Limit access to audit dashboards and records.
  • Use a dedicated Salesforce integration account.
  • Grant only required permissions.
  • Protect user and administrator identifiers.
  • Configure appropriate retention.
  • Align alerts with incident-response and change-management procedures.
  • Avoid exposing credentials, secrets, or OAuth tokens.

Dashboard & Reports

Dashboard & Reports

AI

Insights & Recommendations

Analytics

More Analytics Features

Automation

More Automation Features

​
Get Help

Contact GermainUX Support

The Germain Team can help you set this up.

Can't find what you need?

Search all GermainUX docs with Ctrl + K, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.