Our org is subject to certain compliance rules that means we have to be able to answer who viewed a given record and when, going back up to 6 years.
The org includes a Shield Event Monitoring feature license.
Real-time event monitoring keeps URI events for only 6 months; same issue for the Event Monitoring Analytics App (30 days), thus there's no OOTB solution here that I'm aware of.
How do we solve this with the least amount of work and cost?
The solution we used (and there may be others so other answers are welcome!) was the Salesforce Collector for SumoLogic (that happens to be our enterprise logging tool). The Sumologic Salesforce app requires no install in Salesforce and is a no cost add-on for SumoLogic licensees. The only SFDC config is an integration user + connected app that the collector uses to query the EventLog objects on a regular basis.
And the sumologic query to see who accessed a given Case record can be done using:
_sourceCategory=production/sfdc
| json auto keys "EVENT_TYPE", "URI_ID_DERIVED" as eventtype, uriidderived
| where eventtype = "URI"
| where uriidderived = "500xxxxxxxxxxxxxxx"
where 500xxxxxxxxxxxxxxx is the Id of a case of interest
generates Log entries that would look like:
{"EVENT_TYPE": "URI",
"TIMESTAMP": "20210324135127.148",
"REQUEST_ID": "4axAZm445f_mjikCad-BX-",
"ORGANIZATION_ID": "00D36000000xxxx",
"USER_ID": "005xxxxxxxx",
"RUN_TIME": "606",
"CPU_TIME": "339",
"URI": "/5001Q00001ArxGL",
"SESSION_KEY": "CBsGJzuf4owDIjm0",
"LOGIN_KEY": "dxw6Wt70S46GgCqv",
"REQUEST_STATUS": "S",
"DB_TOTAL_TIME": "266670746",
"DB_BLOCKS": "2986",
"DB_CPU_TIME": "120",
"REFERRER_URI": "",
"TIMESTAMP_DERIVED": "2021-03-24T13:51:27.148Z",
"USER_ID_DERIVED": "005xxxxxxxxxxxx",
"CLIENT_IP": "99.120.xxx.xxx",
"URI_ID_DERIVED": "5001Q00001ArxGLQAZ",
"USER_ID_DERIVED_LOOKUP": "[email protected]"}
So you can see that Fred viewed the Case at 2021-03-24T13:51:27.148Z
The volume of SFDC event logs collected by SumoLogic was a small fraction of the total logs from all other apps so storage costs were lost in the noise. YMMV.
Obviously, the lookback can only go back as far as when you first install the SumoLogic Collector
