Log events

In your Google Admin console, you can review user and administrator activity in your organization. You can use the events below to filter the information in the different audit logs.

To access your audit logs:

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Reports.
  3. On the left, under Audit, click the log you want to see.
  4. (Optional) To filter the log by event name, click Add a filter and then Event name. Enter the event name and click Apply.
 

Open all  |  Close all

User management

User events

 Find data about changes to user information and privileges in the Admin audit log.

Event name Description
2-step Verification Scratch Codes Deletion The 2-Step Verification scratch codes for the specified user were deleted.
2-step Verification Scratch Codes Generate 2-Step Verification scratch codes for the specified user were created.
3-legged OAuth Token Revoke The 3-legged OAuth tokens issued by a specified user for an application were revoked.
Admin Privileges Grant Administrator privileges were granted to the specified user.
Admin Privileges Revoke Administrator privileges were removed from the specified user.
Alias Creation An alias was created for the user.
Alias Deletion Th user’s alias was deleted.
Application Specific Password Revoke The user’s application-specific password with a specified ID was revoked.
Automatic Contact Share Change The automatic contact sharing settings were updated for the specified user.
Bulk Upload An attempt was made to upload multiple users to the specified domain.
Bulk Upload Notification  An email notification of a bulk users upload was sent.
Cancel User Invite The invitation to a user to sign up for the specified domain was canceled.
Create an email monitor An event was created to monitor emails sent by a user to a specific email address over a period of time.
Data transfer request created A request was created to transfer data from one user to another for a specified app.
Delegated Admin Privileges Grant Administrator privileges were given to the specified user.
Delete account information dump The account and sign-in information dump for a user was deleted, along with the request ID.
Delete an email monitor The monitoring of emails sent by a user to a specified email address was stopped.
Delete mailbox dump The mailbox dump for a user was deleted, along with the request ID.
First Name Change The first name of the user was changed to a new value.
Gmail Account Reset The Gmail account for the user was reset.
Last Name Change The last name of the user was changed to a new value.
Mail Routing Destination Creation An individual mail routing destination was created for the specified user.
Mail Routing Destination Deletion The individual mail routing destination for the specified user was deleted.
Nickname Creation A nickname was created for the user.
Nickname Deletion The user’s nickname was removed.
Password Change The user’s password was changed.
Password Change on Next Login The user is required to change their password at their next sign-in.
Request account information The user’s account and sign-in information was requested.
Request mailbox dump A mailbox dump for a user was requested.
Resend User Invite An invitation to sign up for the specified domain was resent to the user.
Reset Cookies and Forced Relogin A user’s cookies were reset and the user was required to sign back in to the system.
Send User Invite An invitation was sent to a user to sign up for the specified domain.
Temporary Password Viewed The temporary password for the user was viewed by the administrator.
Turn off 2-step verification 2-Step Verification was turned off for the user.
Unblock User Session The user’s session was unblocked by temporarily disabling the login challenge.
User BirthDate Change The user’s recorded birth date was updated.
User Creation A user account was created.
User Deletion A user account was deleted.
User List Download A list of users was downloaded as a CSV file.
User OrgUnit Change The user was moved to a different organizational unit.
User Rename The user’s email was renamed.
User Suspension The user’s account was suspended.
User Undeletion The user’s account that was deleted has been reinstated.
User Unsuspension The user’s account that was suspended has been reinstated.
User Upgrade To Google+ The user’s services now include Google+.
Login audit events
See information about user sign-in attempts in your Login audit log.
Event name Description
Failed Login The user failed to sign in.
Login Challenge The user was presented with a login challenge.
Successful Login The user signed in to their account.
License settings events
See the management of user licenses for your organization in the Admin audit log.
Event name Description
Assign Licenses to All Unassigned Users Licenses and Stock Keeping Units (SKUs) for a product were assigned to all unassigned users of an organization.
Assign Licenses to All Users Licenses and SKUs for a product were assigned to all users of an organization.
Assign User License A new license and SKU for a product were assigned to the specified user.
Auto Assign Licenses The license autoassign option was changed for a product and SKU.
Reassign User License The product license and old SKU were reassigned to a new SKU for a user.
Revoke Licenses to All Users The licenses and SKUs for a product were removed from all users of an organization.
Revoke User License The license and SKU for a product were removed from the specified user.
Organizational unit events
Review changes to organizational units in the Admin audit log.
Event name Description
OrgUnit Creation The specified organizational unit was created.
OrgUnit Deletion The specified organizational unit was deleted.
OrgUnit Description Change The description of the  organizational unit was changed to a new value.
OrgUnit Move The organizational unit was moved to a new parent unit.
OrgUnit Name Change The organizational unit’s name was changed to a new value.
Service Change The named service was turned on or off for the specified organizational unit.
Directory settings events
See changes to your Directory service in the Admin audit log.
Event name Description
Contacts Setting Change The specified setting for the Directory service in this domain was changed to a new value.

 Groups management

Group events
Review changes made to Google Groups in your organization in the Admin audit log.
Event name Description
Group Creation An email group was created.
Group Deletion An email group was removed.
Group Description Change The description of the email group was changed.
Group Member Creation A new user was added to a group mailing list.
Group Member Deletion The user’s email was removed from the group mailing list.
Group Name Change The name of the email group was changed to a new value.
Group Setting Change The specified setting for a group mailing list was changed to a new value.
Moderator action events
The Groups audit log reports actions that moderators take when managing their groups.
Event name Description
Actor user accepted invitation to a group The user accepted the invitation to join a group.
Actor user joined a group The user added themself to the group.
Group basic setting changed The group moderator changed the group’s basic permissions setting.
Group created The group moderator created a group.
Group deleted The group moderator deleted a group.
Group identity setting changed The group moderator changed the group’s identity setting to a new value.
Group info setting added The group moderator added a new value to the group’s information setting.
Group info setting changed The group moderator changed a value in the group’s information setting.
Group info setting removed The group moderator removed a value from the group’s information setting.
Group new members restriction settings changed The group moderator changed the new member’s restriction setting to a new value.
Group permission changed The group moderator changed the group’s permission setting.
Group post replies setting changed

The group moderator changed the post replies setting to a new value.

Group spam moderation setting changed The group moderator changed how to handle spam messages.
Group topic setting changed The Group moderator changed the topic types setting to a new value.
Message moderated A message has been moderated.
Posts from users will always be posted Messages to the group won’t be moderated before they’re posted.
User added to a group The group moderator added the user to the group.
User banned from group during message moderation The group moderator banned the user from the group.
User invitation revoked from a group The group moderator revoked the user’s invitation to join the group.
User invited to a group The group moderator invited the user to join the group.
User join request rejected from a group The group moderator rejected the user’s request to join the group.
User reinvited to a group The group moderator sent a new invitation to the user to join the group.
User removed from a group The group moderator removed the user from the group.

Setup and security

Domain events
See the changes made to the domains that you manage in your Google Admin console in the Admin audit log.
Event name Description
Account Automatic Renewal Change The account automatic renewal setting value was changed.
Add Application The specified application was added to the domain.
Add Application to Whitelist The specified application was added to the domain’s allow list.
Advertisement Option Change The advertisement option for the domain was changed.
Alert Receivers Change The list of receivers of an alert has changed.
Alert Status Change The status of an alert was changed to a new value.
Alias Creation An unverified domain alias was created for the specified domain.
Alias Deletion A domain alias for a specified domain was deleted.
Alias MX Record Verification The MX records for the domain alias of the specified domain were verified.
Alias Verification The specified method was used to verify the domain alias.
All API OAuth Access Change OAuth access for all APIs for the specified domain was changed.
Allow Admin Password Reset Resetting of the administrator’s password for the domain was enabled.
API Access Change The API access for the domain was changed.
API Client Access Authorize API client access to the domain is allowed from clients authorized for the specific APIs.
API Client Access Remove API client access to a domain was removed from a client.
Change Whitelist Setting A domain’s allow list setting value was changed.
Conflict Account Action Change The conflict account action value for the domain was changed.
Contact for Feedback Setting Change Feedback solicitation was turned on or off for the domain.
Contact Sharing Change Contact sharing values for the domain were changed.
Create MDM vendor enrollment token An EMM vendor enrollment token was created for Google Play for Work.
Custom Logo Change

A new custom logo for the domain was set for use.

Custom Logo Upload A new custom logo for the domain was uploaded.
Delete MDM vendor enrollment token An EMM vendor enrollment token for Google Play for Work was deleted.
Domain Default Locale Change The default locale for the domain was changed.
Domain Default Timezone Change The default time zone for the domain was changed.
Domain Name Change The name of domain was changed.
Domain Pre-release Setting Change Pre-release features were turned on or off for the domain.
Domain Support Message Change The support message for the domain was changed.
Education Organization Type Change The education organization type for the domain was changed.
Enable OAuth Consumer Key The value of the enabling OAuth consumer key was changed.
Enable SSO Change SSO was turned on or off for the domain.
Enforce SSL Change The SSL enforcement setting was changed.
Login Background Color Change The background color for the sign-in dialog was changed.
Login Border Color Change The border color for the sign-in dialog was changed.
Marketplace Login Audit Change The Marketplace sign-in audit was changed.
MDM vendor enrollment The Google Play for Work EMM provider used a generated token to enroll for mobile device management.
MDM vendor unenrollment Mobile device management services were removed from a Google Play for Work EMM provider.
MX Record Verification Claim The user’s email address was used to verify the MX records for a specified domain.
New Service Update The automatic addition of new services and pre-release features was turned on or off for the domain.
Next Generation CPanel Setting Change Access to new Admin console was turned on or off.
OAuth Certificate Upload A new OAuth certificate for the domain was uploaded.
OAuth Consumer Secret Regenerate A new OAuth consumer secret for the domain was created.
OpenId Change The OpenID federated sign-in setting was changed for the domain.
Organization Name Change The organization name for domain was changed.
Outbound Relay Change The outbound relay for the domain was changed.
Password Maximum Length Change The maximum length for passwords in the domain was changed.
Password Minimum Length Change The minimum length for passwords in the domain was changed.
Primary Admin Change The primary administrator for the domain was changed.
Receive Email Notification Setting Change The domain’s notification setting for received emails was changed.
Remove Application The specified application was removed from the domain.
Remove Application from Whitelist The specified application was removed from the domain’s allow list.
Renew Domain Registration Setting Change The setting for domain registration renewal was changed.
Secondary Domain Creation An unverified secondary domain was created for the specified domain.
Secondary Domain Deletion The domain’s secondary domain was deleted.
Secondary Domain MX Verification The MX records of secondary domain were verified.
Secondary Domain Verification The domain’s secondary domain was verified.
Secondary Email Change The secondary email for the domain changed to a new email address.
SSO Setting Change The SSO settings for the domain were changed.
Support PIN Generation A customer support PIN was created.
Security settings events
See the changes made to your Security settings in your Admin audit log.
Event name Description
Allow 2-Step Verification 2-Step Verification was turned on or off for the domain.
Allow ASP without 2-step verification The setting that allows application-specific passwords without using 2-Step Verification was turned on or off.
Change IP Whitelist The IP allow list for the specified service was changed.
Enable Non-Admin User Password Recovery The non-admin user password recovery setting for this organization was turned on or off.
Enforce 2-Step Verification Required 2-Step Verification was turned on or off.
Session length changed The session length value was changed.
Admin role setting events
See information about the creation, editing, and assigning of admin roles in the Admin audit log.
Event name Description
Role Assign An admin role was assigned to the specified user.
Role Creation An admin role was created.
Role Deletion The specified admin role was deleted.
Role Privilege Creation A privilege was added to the specified admin role.
Role Privilege Deletion A privilege was removed from the specified admin role.
Role Rename The name for the specified admin role was changed to a new value.
Role Unassign The admin role was removed from the specified user.
Role Updated The existing admin role was changed.
Migration settings events
See migration events in your Admin audit log.
Event name Description
Migration Setup Migration was set up for the domain.
Migration Speed updated The speed of migration was changed to the specified value.
Migration Started for some users Migration was started for the specified number of users.
Migration Stopped for some users Migration was stopped for the specified number of users.
System settings events
See changes to system settings in the Admin audit log.
Event name Description
System Setting Change The specified system setting in this domain was changed to a new value.

Device and Chrome management

Device settings events
Review changes to your managed devices in the Admin audit log.
Event name Description
Device OrgUnit Change A device with the specified serial number was moved to a different organizational unit.
Google Meet hardware settings events
See changes to the settings for Chromebox for meetings devices in the Admin audit log.
Event name Description
Chromebox for meetings Device Setting Change The setting for Chromebox for meetings in this organizational unit was changed to a new value.
Mobile settings events
See changes made to the mobile devices you manage for your organization in the Admin audit log.
Event name Description
Add Mobile certificate A mobile device certificate was added for all mobile devices.
Mobile Device Approve The user’s mobile device was approved.
Mobile Device Block The user’s mobile device was blocked.
Mobile Device Deletion The mobile device for the specified user was deleted.
Mobile Device Wipe The user’s mobile device was wiped.
Mobile Setting Changed The specified mobile setting was changed to a new value.
Mobile Wireless Network Change The mobile wireless network was changed for all mobile devices.
Mobile Wireless Network Creation A mobile wireless network was created for all mobile devices.
Mobile Wireless Network Deletion The mobile wireless network was deleted for all mobile devices.
Remove Mobile certificate The mobile device certificate was removed for all mobile devices.
Wipe Mobile Account The user’s mobile account was wiped.
Wipe On Mobile Cancel And Approve Device The wipe on service for the user’s mobile was canceled and the device was approved.
Wipe On Mobile Cancel And Block Device The wipe on service for the user’s mobile was canceled and the device was blocked.
Chrome OS settings events
See changes to your organization's Chrome OS settings in the Admin audit log.
Event name Description
Chrome OS Device Setting Change The specified setting for Chrome OS devices in this organizational unit was changed.
Chrome OS Setting Change The specified Chrome OS setting was changed.
Chrome OS User Setting Change The specified setting for Chrome OS users in this organizational unit was changed.

Services management

Calendar events
Review changes to your Google Calendar service and resources in the Admin audit log.
Event name Description
Calendar Resource Creation The specified calendar resource was created.
Calendar Resource Deletion The specified calendar resource was deleted.
Calendar Resource Rename The name for the specified calendar resource was changed to a new value.
Calendar Setting Change The specified setting for the Calendar service was changed to a new value.
Calendar change events
See the changes made to calendars and events in your Calendar audit log.
Event name Description
Calendar access level(s) changed The user changed the access permissions of a calendar.
Calendar country changed The user changed the country setting of a calendar.
Calendar created The user created a calendar.
Calendar deleted The user deleted a calendar.
Calendar description changed The user changed the description of a calendar.
Calendar location changed The user changed the location of a calendar.
Calendar timezone changed The user changed the time zone of a calendar.
Calendar title changed The user changed the title of a calendar.
Event created The user created a calendar event.
Event deleted The user deleted a calendar event.
Event guest added The user invited a guest to the specified event.
Event guest removed The user removed a guest from a calendar event.
Event guest response changed The response of the specified guest for the event was changed.
Event modified The user edited a calendar event.
Event removed from trash The user removed a calendar event from the trash.
Event restored The user restored a calendar event.
Event start time changed The user changed the start time of an event.
Event title modified The user changed the title of an event.
Subscription added The user subscribed to notifications for a calendar.
Subscription deleted The user unsubscribed from notifications for a calendar.
Sites settings events
See changes to your organization's Google Sites settings in the Admin audit log.
Event name Description
Sites Setting Change The setting for Google Sites on this domain was changed.
Document settings events
See changes affecting Drive and ownership of documents in the Admin audit log.
Event name Description
Document Ownership Change The document was transferred to a new owner.
Drive Data Restore Drive data restoration was started for the specified user.
Drive Setting Change The specified Drive setting value was changed.
Drive ACL events
See sharing changes made to Google Drive files in the Drive audit log.
Event name Description
Editor Settings Change The user changed the editor settings to a new value.
Link Sharing Access Type Change The user changed the access level to a new value.
Link Sharing visibility change The user changed the visibility setting to a new value.
User Sharing Permissions Change The user changed the sharing permissions to a new value.
View The user viewed an item.
Drive access events
See information about the creation and editing of Drive files in the Drive audit log.
Event name Description
Add to folder The user added an item to a folder.
Create The user created a document.
Delete The user deleted an item from the Trash.
Download The user downloaded an item.
Edit The user edited an item.
Move The user moved an item from one folder to another.
Remove from folder The user removed an item from a folder.
Rename The user changed the name of an item.
Restore The user restored an item from the Trash.
Trash The user moved an item to the Trash.
Upload The user uploaded an item.
Email settings events
See changes to your organization's Gmail settings in the Admin audit log.
Event name Description
Email Log Search A search was performed for all email logs matching the specified criteria.
Email Setting Change The specified email service setting value was changed.
Gmail Setting Change The specified Gmail setting was changed.
Gmail Setting Creation The specified Gmail setting was added.
Gmail Setting Deletion The specified Gmail setting was removed.

App management

Application settings events
See the changes made to the settings for applications in the Admin audit log.
Event name Description
Application Setting Change The specified application setting was assigned a new value.
Application Setting Creation A setting with the specified value was created for this application.
Application Setting Deletion The specified application setting was deleted.
Google+ Premium Features The Premium features settings for the Google+ service were changed.
SAML 2.0 service provider configuration settings events
See changes made to your SAML configuration settings in your Admin audit log.
Event name Description
Change SAML 2.0 Service Provider's Acs Endpoint The SAML 2.0 service provider's Assertion Consumer Service (ACS) endpoint was changed to a new value.
Change SAML 2.0 Service Provider's Description The SAML 2.0 service provider's description was changed to a new value.
Change SAML 2.0 Service Provider's Entity Id The SAML 2.0 service provider’s entity ID was changed to a new value.
Change SAML 2.0 Service Provider's Logo The SAML 2.0 service provider's logo was changed to a new value.
Change SAML 2.0 Service Provider's Name The SAML 2.0 service provider’s name was changed to a new value.
Change SAML 2.0 Service Provider's Start Url The SAML 2.0 service provider's starting URL was changed to a new value.
Create SAML 2.0 Service Provider Configuration The SAML 2.0 service provider’s configuration with the specified name and entity ID was created.
Delete SAML 2.0 Service Provider Configuration The SAML 2.0 service provider’s configuration with the specified name and entity ID was deleted.
OAuth token audit events
See when users grant or remove access to applications in your Token audit log.
Event name Description
Authorize The user authorized access to the specified application.
Revoke The user removed access to the specified application.
Was this helpful?
How can we improve it?