Audit Log records all operations that an admin does under Setup. When there are multiple administrators, the audit log provides information on who, what, when, and where an action was performed.
Role Required: SDAdmins
Go to Setup > Data Administration > Audit Log. You can view the audit log entries in a linear view or a threaded view.
- Lists details of operations in organized columns.
- Displays details of operations and their dependent operations in groups.

Filter logs by operations, modules, users, and time.
To filter logs based on criteria,
Click the Filter field.
Select criteria from the available options: Action, Module, Performed by, and Admin Log ID.
Click
to add more filter conditions.
Click Search.

To filter logs based on time,
Click Date Filter on the top-right to filter logs based on predefined time values or custom values.
Choose the date range from the available options: All, Today, Last 7 days, Last 30 days, This month, Last month. Use Custom Range to customize the time frame.

Click the Sort
icon on the top-right of the header to sort logs based on time.
Use the Data Export option to download audit logs in CSV format from the threaded view or linear view. Users can export audit logs in a standardized format for enhanced usability. This makes the logs readily accessible for internal review and supports detailed analysis.
You can export all data or export only specific data filtered based on date range, operations, module, and users.
To export data,
Go to Thread view or Linear view.
To export all data, click Data Export.
To export filtered data, apply filter criteria and click Data Export.
After the data export is complete, you will get an email, push, and bell notification. You can click on the notification to download the file.
Bell notification:

Push notification:

If the exported file is smaller than 50MB, it will be attached to the email notification as a downloadable file as shown below. If the file size exceeds 50MB, the email will contain a download link instead. The downloaded file displays a maximum of 10,000 records.

The downloaded log file displays the following information:
Name of the module
Operation performed
Performed By
Modified column
Time
Remote IP
Device name