Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more
In the Google Admin console, you can use the audit and investigation tool to review user and administrator activity in your organization. See the table below for details about the available data sources.
Choose a data source to get started
To access data about log events on the audit and investigation tool, at the left of your Admin console, click ReportingAudit and investigation
then select your data source.
Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.
| Data source | Description |
|---|---|
| Admin log events | View admin activity in the Google Admin console |
| Calendar log events | View and track changes to user events in Google Calendar |
| Chat log events | Track user conversations and room activity |
| Chrome log events | View Chrome events for your organization |
| Chrome Sync log events | View a record of actions by users who have Chrome Sync enabled |
| Classroom log events | View common activities, such as who removed a student from a class or archived a class Note: You must be a Google Workspace for Education admin to access Classroom log events |
| Cloud Search log events | View user actions in Cloud Search |
| Contacts log events | View Contacts activity in the Google Admin console |
| Devices log events | Review activities on your organization’s devices |
| Directory Sync log events | View events related to Directory Sync |
| Drive log events | View user Google Drive activity |
| Graduation log events | Track user data transfer |
| Groups Enterprise log events | See Admin console actions on groups and group memberships |
| Groups log events | View user changes to groups in Google Groups |
| Jamboard log events | Track changes to Jamboards |
| Keep log events | Track activity on notes owned by users in your organization |
| Looker Studio log events | View users' actions in Looker Studio |
| Meet log events | Understand users' video-meeting activity |
| Meet recordings in Drive audit & export | Track users' Meet recording activity |
| OAuth log events | Track third-party app usage and data-access requests |
| Password Vaulted Apps log events | See admin and user activity related to password vaulted apps |
| Profile log events | View user Profile activity |
| Rule log events | Track your users' attempts to share sensitive data |
| SAML log events | View your users' sign-ins to SAML applications |
| Secure LDAP log events | Review LDAP operations for the Secure LDAP service |
| Takeout log events | View user Google Takeout activity |
| Tasks log events | View user actions related to tasks, task lists, and recurring tasks |
| User log events | View user activity across their accounts. Note: The User log events data source provides data previously contained in the Login audit log and User accounts audit log. |
| Vault log events | Review user activity in Google Vault |
| Voice log events | Review user activity in Google Voice |
When and how long is data available?
Go to Data retention and lag times.