Drive Audit Log for G Suite Business and G Suite Enterprise
As a G Suite administrator, you can use the Drive audit log to collect and see a list of your domain's user activity; for example, view, create, preview, print, update, delete, download, or share Drive content.
In this article, we will discuss the process to track the drive details of users and how to export the log data from the Google Admin console.
*Note that this feature is only available in G suite business and G suite enterprise versions**
Step 1: Open your Drive audit log:
-
In your Google Admin console (at admin.google.com)...
-
Go to Reports.
-
On the left, click Audit
Drive.
-
You might have to scroll to see Audit.
-
On the toolbar, click Select columns and
select the data you want to show in your log.
-
See below for how to interpret and customize log data
Step 2: Understand Drive audit log data:
Data You can View:
The Admin console bases its Drive audit logs on the following user data:
|
Data Type |
Description |
Filtering within the Admin Console |
|
Event name |
User action, such as View, Rename, Create, Edit, Preview, Print, Update, Delete, Download, or Share. When you copy files, the type of action logged depends on the file type:
Preview events in the Drive viewer and Print events in the Drive viewer and the Google Docs editors may be delayed up to 12 hours from the time of the event. Viewing Trash on a Team Drive is not logged. Change Theme on a Team Drive is not logged. |
Filterable |
|
Event description |
Summary of the event |
Not filterable |
|
Item type |
File format that the activity involves, such as Google Docs, Sheets, Slides, JPEG, PDF, PNG, MP4, Microsoft® Word®, Excel®, PowerPoint®, txt, HTML, MPEG audio, QuickTime®video, folder, or Team Drive. |
Filterable |
|
Item ID |
Unique Drive item identifier associated with the activity, as stored in the URL link for the file. |
Filterable |
|
Visibility |
Visibility of the Drive item associated with the activity. |
Filterable |
|
Prior Visibility |
Visibility of the Drive item prior to the activity. |
Filterable |
|
User |
Email address of the user who performed the activity. Users external to the domain who initiate events are shown as anonymous, except when they view or edit a document explicitly shared with them (as an individual or as part of a specific group). |
Filterable; also works if only the domain name is entered |
|
Owner |
User who owns the file. |
Filterable |
|
Date and time range |
Date and time the event occurred. |
Filterable |
|
IP address |
Address from where the user performed the activity. This might reflect the user's physical location, but it can be something else like a proxy server or a Virtual Private Network (VPN) address. No IP addresses are logged for events:
|
Not filterable |
File visibility and sharing permissions:
You can see information about how the sharing permissions on a file change. To see files that are shared with users outside of a domain, under Visibility, select Shared Externally.
If you turn off external sharing and a user shares a resource with a group that allows external users, data will be marked Shared External in the log. However, any external users in the group can’t access the shared resource. And, you’ll see this even if the group doesn’t have any external users.
Step 3: Customize and export your audit log data:
Filter the audit log data by user or activity.
You can narrow your audit log to show specific events or users. For example, find all log events for when a user was presented with a login challenge, or find all login activity for a particular user.
-
Open your Login audit log as shown above.
-
If you don't see the Filters section, click Filter.
-
Enter or select the criteria for your filter. You can filter on any combination of the data you can view in the log.
-
Click Search.
Export your audit log data:
You can export your Login audit log data to a Google Sheet, or download it to a CSV file.
-
Open your Login audit log as shown above.
-
(Optional) To change the data to include in your export, on the toolbar, click Select Columns.
-
On the toolbar, click Download.
