In the Google Admin console, you can use the audit and investigation tool to review user and administrator activity in your organization.
See the table below for details about the different data sources that are available in the tool.
Your access to the audit and investigation tool
- Your ability to run a search in the audit and investigation tool depends on your Google edition, your administrative privileges, and the data source. You can run a search in the audit & investigation tool on all users, regardless of their Google Workspace edition.
- If you have a premium Google Workspace edition (Enterprise Plus, Enterprise Standard, or Education Plus), you have access to the security investigation tool, which provides more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. For details, go to About the security investigation tool.
Choose a data source to get started
To access data about log events on the audit and investigation tool, at the left of your Admin console, click ReportingAudit and investigation
then select your data source.
| Data source | Description |
|---|---|
| Admin log events | View admin activity in the Google Admin console |
| Calendar log events | View and track changes to user events in Google Calendar |
| Chat log events | Track user conversations and room activity |
| Chrome log events | View Chrome events for your organization |
| Chrome Sync log events | View a record of actions by users who have Chrome Sync enabled |
| Classroom log events | View common activities, such as who removed a student from a class or archived a class Note: You must be a Google Workspace for Education admin to access Classroom log events |
| Cloud Search log events | View user actions in Cloud Search |
| Contacts log events | View Contacts activity in the Google Admin console |
| Devices log events | Review activities on your organization’s devices |
| Directory Sync log events | View events related to Directory Sync |
| Drive log events | View user Google Drive activity |
| Graduation log events | Track user data transfer |
| Groups Enterprise log events | See Admin console actions on groups and group memberships |
| Groups log events | View user changes to groups in Google Groups |
| Jamboard log events | Track changes to Jamboards |
| Keep log events | Track activity on notes owned by users in your organization |
| Looker Studio log events | View users' actions in Looker Studio |
| Meet log events | Understand users' video-meeting activity |
| Meet recordings in Drive audit & export | Track users' Meet recording activity |
| OAuth log events | Track third-party app usage and data-access requests |
| Password Vaulted Apps log events | See admin and user activity related to password vaulted apps |
| Profile log events | View user Profile activity |
| Rule log events | Track your users' attempts to share sensitive data |
| SAML log events | View your users' sign-ins to SAML applications |
| Secure LDAP log events | Review LDAP operations for the Secure LDAP service |
| Takeout log events | View user Google Takeout activity |
| Tasks log events | View user actions related to tasks, task lists, and recurring tasks |
| User log events | View user activity across their accounts. Note: The User log events data source provides data previously contained in the Login audit log and User accounts audit log. |
| Vault log events | Review user activity in Google Vault |
| Voice log events | Review user activity in Google Voice |
When and how long is data available?
Go to Data retention and lag times.
