Collect Logs for the Salesforce App

Prerequisites

The Salesforce Event Monitoring add-on is required to obtain all of the data presented in the app dashboards.  The add-on enables access all event types in the Salesforce EventLogFile, the LoginEvent object, Transaction Security, and the Event Monitoring Analytics App. For more information, see Get Started with Event Monitoring and Enable Event Monitoring.

Process overview

This page provides instructions for new and upgrade installations:

• Configure a new SumoJanus installation for Salesforce
• Upgrade an existing SumoJanus installation for Salesforce

Step 1: Set Salesforce user permissions

To create a permission set and assign it to a user

1. In Salesforce, go to Setup > Administer > Manage Users > Permission Sets.  
2. Create a permission set with the API Enabled permission and either the View Event Log Files or the View All Data permission. For more information, see Create Permission Sets in Salesforce help.
3. On the Permission Set Overview > System Permissions page, select API Enabled and View Event Log Files.
   
4. Click the Manage Assignments button in the permission set you just created, and click Add Assignments.
5. Find your user and assign that user to the permission set you just created.
6. Save your changes.

Step 2: Install the collector and download the SumoJanus package

In this section you will install a Sumo Logic collector and download the necessary SumoJanus package.

Step 3: Deploy the SumoJanus package

This section provides steps for a new SumoJanus installation.. 

Step 4: Configure the SFDC Bundle

1. Go to the unzipped sumojanus-salesforce folder.
2. Open the file conf/sumologic.properties and add the following section to the end of the file (do not overwrite any existing content in the file):
   
   [salesforce]
url = <Salesforce Instance URL>
token_file_path = ${path}/data/salesforce.token
record_file_path = ${path}/data/sf_readfiles.dat
# if you are using a SFDC sandbox environment, set the following to true
sandbox = false
interval = daily
    
3. Set the following properties:
   1.  url—Point to your Salesforce URL. For example:
      https://na25.salesforce.com
   2. sandbox—If you are is using a sandbox environment, set the property to true. It is set to false by default.
   3. start_time—If you don’t specify start_time, logs will be collected from two days in the past.
   4. interval—Controls whether you collect daily or hourly logs. Note that later in this procedure, in  Step 7: Configure a script source, the setting you specify for Frequency, should correspond to the interval setting.

In the file conf/sumologic.properties, the following properties are supported.

Step 5: Configure the JRE path

On Windows, update SumoJanus_SF.bat

Navigate to the folder where you installed SumoJanus, and open SumoJanus_SF.bat  in a text editor. Line 3 of the script sets JAVAPATH to C:\Program Files\Sumo Logic Collector\jre\bin as shown below:

set JAVAPATH="C:\Program Files\Sumo Logic Collector\jre\bin"

If your collector JRE is in a different location, update Line 3 accordingly.  

On Linux, update SumoJanus_SF.bash

Navigate to the folder where you installed SumoJanus, and open SumoJanus_SF.bash  in a text editor. Update the script as follows:

1. Add a line that sets JAVA_HOME to point to the location of your JRE,  just before the last line of the script. For example, if your collector's JRE is in /opt/SumoCollector/jre/bin, insert this line:
   
   JAVA_HOME=/opt/SumoCollector/jre/bin

2. The last line of the script is:
   
   java -jar ${SUMOJANUS_JAR_FILE} ${runMode} SalesforceCollector-3.1.0.jar -e 1800
   
   Prefix the line with $JAVA_HOME/, like this:
   
   $JAVA_HOME/java -jar ${SUMOJANUS_JAR_FILE} ${runMode} SalesforceCollector-3.1.0.jar -e 1800

Step 6: Authenticate with Salesforce

After completing the previous steps, you should authenticate the installation with the task outlined in this section.

To authenticate the installation, do the following:

1. Log out of SalesForce. >
2. Run the following command under the unzipped sumojanus-salesforce folder:
   • On Unix-like systems: bin/SumoJanus_SF.bash -s
   • On Windows: bin\SumoJanus_SF.bat -s
3. A browser will open (if it doesn't, see If your browser does not open, below):
   • If your browser has already authenticated with Salesforce, a message will display saying that access has been granted.
   • Otherwise, you will see the Salesforce login. Supply your credentials (with the required permissions) to grant access.
4. You will then see the following message, which says that the token file has been created:
   
   
5. Don't close the session where you ran bin/SumoJanus_SF.bash -s.

Step 7. Configure a script source

In Sumo Logic, configure a Script Source using the instructions in Script Source. New Collectors using version 19.245-4 and later do not allow the creation of Script Sources by default. To allow Script Sources you need to set the Collector parameter enableScriptSource=true in user.properties to true.

For the Sumo Logic App for Salesforce, use the following configuration settings:

• Frequency. 
  • For daily log files, set frequency to every 6 hours.
  • For hourly log files, set frequency to 1 hour. 
• Specify a timeout for your command:
  • For daily log files, set timeout to every 3 hours. 
  • For hourly log files, set timeout to 1 hour.
• Command: /bin/bash
  • On Unix-like systems: /bin/bash
  • On Windows: Windows Script 
• Type a path to the script to execute:
  • On Unix-like systems: /opt/SumoCollector/sumojanus/bin/SumoJanus_SF.bash
  • On Windows: c:\Program Files\SumoCollector\sumojanus\bin\SumoJanus_SF.bat

• Working Directory:
  • On Unix-like systems: /opt/SumoCollector/sumojanus
  • On Windows: c:\Program Files\SumoCollector\sumojanus
• Advanced Options for Logs
  • Timezone: Select "UTC".
  • Timestamp Format: yyyy-MM-dd'T'HH:mm:ss.SSS
  • Timestamp Locator: TIMESTAMP_DERIVED\":\"([^\"]+)\"