# Debug logs, audit trails and login history

*Platform Administrator II Study Guide · Auditing and Monitoring · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-administrator-ii/auditing-and-monitoring/debug-logs-audit-trails-and-login-history*

Which record answers which question: debug logs and trace flags for a transaction, Setup Audit Trail for configuration changes, Login History for sign-ins, field history tracking for record values and Event Monitoring for user activity, with the limits and retention windows that decide each scenario.

- Certification: Salesforce Platform Administrator II
- Exam section: Auditing and Monitoring
- Study guide: https://www.certifyforce.com/study-guide/platform-administrator-ii

**Official exam objective:**

> Given a scenario, determine the appropriate tools for monitoring and troubleshooting system activity (debug log, set up audit trail).

## What the exam expects

- Choose the right record for a monitoring question: debug log, Setup Audit Trail, Login History, field history tracking or Event Monitoring.
- Set up a debug log with user and Apex class or trigger trace flags and debug levels, and explain why a log is missing, truncated or blocked.
- Read Setup Audit Trail entries, including the Delegate User column, and plan for its 180-day window.
- Retrieve old or API logins from Login History and read its status and IP columns.

Key terms: **trace flag** (a log type, a debug level per category, a start and an end time that switch logging on); **debug level** (a named set of log levels, one per category); **Setup Audit Trail** (the history of setup changes); **Login History** (the record of login attempts); **field history tracking** (old and new values of chosen fields on records).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Debug log size | 20 MB maximum; older lines removed beyond it | [Debug Logs](https://help.salesforce.com/s/articleView?language=en_US&id=sf.code_debug_log.htm&type=5) |
| Debug log retention | System logs 24 hours; monitoring logs seven days | [Debug Logs](https://help.salesforce.com/s/articleView?language=en_US&id=sf.code_debug_log.htm&type=5) |
| Org log storage | Over 1,000 MB blocks adding or editing trace flags | [Debug Logs](https://help.salesforce.com/s/articleView?language=en_US&id=sf.code_debug_log.htm&type=5) |
| CLASS_TRACING | Overrides levels; cannot generate logs on its own | [Debug Log Levels](https://help.salesforce.com/s/articleView?id=platform.code_setting_debug_log_levels.htm&language=en_US&type=5) |
| Lead conversion | Transactions it triggers are not in debug logs | [Debug Logs](https://help.salesforce.com/s/articleView?language=en_US&id=sf.code_debug_log.htm&type=5) |
| Setup Audit Trail UI | 20 most recent changes; download covers 180 days | [Setup Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=sf.admin_monitorsetup.htm&type=5) |
| Login History page | Up to 20,000 records for 6 months; download for more | [Login History](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.users_login_history.htm&type=5) |
| API logins | Included in the download with All Logins | [Login History](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.users_login_history.htm&type=5) |
| Field history retention | 18 months, 24 via the API, without Field Audit Trail | [Field History Tracking](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5) |
| Event Monitoring licence | Shield or Event Monitoring add-on | [Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&language=en_US&type=5) |

## Check yourself

- Why can a debug log not explain an automation failure from last month?
- When does Salesforce stop users from adding or editing trace flags?
- Why might automation that fires on lead conversion be absent from a trace?
- Which Login History column shows the client address that first reached Salesforce?

## Sources

- [Debug Logs](https://help.salesforce.com/s/articleView?language=en_US&id=sf.code_debug_log.htm&type=5)
- [Set Up Apex Class and Trigger Trace Flags](https://help.salesforce.com/s/articleView?id=platform.code_debug_log_classes_setup.htm&language=en_US&type=5)
- [Debug Log Levels](https://help.salesforce.com/s/articleView?id=platform.code_setting_debug_log_levels.htm&language=en_US&type=5)
- [Monitor Setup Changes with Setup Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=sf.admin_monitorsetup.htm&type=5)
- [Monitor Login History](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.users_login_history.htm&type=5)
- [Field History Tracking Overview](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5)
- [Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator II pack (USD $19): https://www.certifyforce.com/practice-exams