Login audit log

Track user sign-in activity
If you have the legacy free edition of G Suite, upgrade to G Suite Basic to get this feature. 

As a Google administrator, use the Login audit log to track sign-ins to your domain. All sign-ins from web browsers are logged, including successful, unsuccessful, and suspicious attempts. Suspicious login events are shown with a red warning icon. When users sign in from a mail client or non-browser application, only suspicious attempts are logged. Sign-ins by suspended users are not logged.

Step 1: Open your Login audit log

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Reports.

    To see Reports, you might have to click More controls at the bottom.

  3. Click Login.
  4. Optionally, at the top right, click Select columns Select columns. Select the columns you want to see or hide:
    • IP Address—Internet Protocol (IP) address used by the user to sign in.
    • Date—Date the sign-in occurred (displayed in your default time zone).
    • Login Type (SSO only)—Displays the ways the user signed in:
      • Exchange - by providing an existing credential and exchanging it one of another type. For example, exchanging an OAuth token for a security identifier (SID)
      • Google Password - with a Google password
      • Reauth - with a password re-authentication request
      • SAML - via single sign-on Security Assertion Markup Language (SAML)
      • Unknown - using an unknown method

Step 2: Understand Login audit log data

Data you can view
Data Type Description
Event name The action that was logged, such as a login challenge or a failed login attempt. See Event name descriptions for details.
Event description Details of the event described in the Event name field.
IP address Internet Protocol (IP) address that the user used to sign in to the Admin console. This might reflect your physical location, but it can be something else like a proxy server or a Virtual Private Network (VPN) address.
Login Type  Details of how the user signed in.
Date and time range Date and time the event occurred (displayed in your browser's default time zone).
Event name descriptions

Here are types of events that are available under the Event name column (see above):

Event name Description
Failed Login Log entry for each time a user fails to log in.
Government-backed attack Log entry for each time government-backed attackers may have tried to compromise a user account or computer. Click here to learn more about government-backed attacks.
Login challenge Log entry for each time a user was presented with a login challenge.
Logout Log entry for each time a user logged out.
Successful Login Log entry for each time a user logged in.
Suspicious Login Log entry for each time a user logged in and the login had some unusual characteristics, for example the user logged in from an unfamiliar IP address.

Step 3: Customize and export your audit log data

Filter the audit log data by user or activity

You can narrow your audit log to show specific events or users. For example, find all log events for when a user was presented with a login challenge, or find all login activity for a particular user.

  1. Open your Login audit log as shown above.
  2. If you don't see the Filters section, click Filter Filter.
  3. Enter or select the criteria for your filter. You can filter on any combination of the data you can view in the log.
  4. Click Search.

Export your audit log data

You can export your Login audit log data to a Google Sheet, or download it to a CSV file.

  1. Open your Login audit log as shown above.
  2. (Optional) To change the data to include in your export, on the toolbar, click Select columns Select columns.
  3. On the toolbar, click Download Download.

You can export up to 210,000 cells. The maximum number of rows depends on the number of columns you select.

How old is the data I'm seeing?

For details on exactly when data becomes available and how long it's retained, see Data retention and lag times.

Step 4: Set up email alerts

You can receive email alerts for sign-in activity based on your filters.

  1. Open your Login audit log as shown above.
  2. If you don't see the Filters section, click Filter filter .
  3. In the Filters section, select the criteria to filter. You can use any combination of filters, except IP Address and Date and time range.
  4. Click Set Alert.
  5. Enter an Alert name.
  6. Choose the recipients of the email alert:
    1. Check the box to deliver the email alert to super administrators.
    2. Enter the email addresses of any other email alert recipients.
  7. Click Save.

To edit your custom alerts, refer to Administrator email alerts.

Was this article helpful?
How can we improve it?