Search
Clear search
Close search
Google apps
Main menu
true

Calendar audit log

Track calendar notifications and view changes to your users’ calendars, events, and subscriptions

This feature isn't available in the legacy free edition of Google Apps or the government edition of G Suite.

As a G Suite administrator, you can track changes to calendars, events, and subscriptions in the Google Calendar audit log. You can also track the email notifications associated with these actions in the audit log. This information is helpful when you troubleshoot issues or when your users notice discrepancies or unexpected changes to their calendars, shared calendars, or specific calendar events. Log entries usually appear within one half-hour of the user action.

Note: Calendar audit log entries show only up to the past six months of data. Support will not have access to information outside that time frame.

Step 1: Open your Calendar audit log

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console dashboard, go to Reports.

    To see Reports, you might have to click More controls at the bottom.

  3. Click Calendar.
  4. On the toolbar, click Select columns Select columns. Then select the data you want to show in your log.
  5. See below for how to interpret and customize log data.

Step 2: Understand Calendar audit log data

Data you can view
Data Type Description
Activity name The action that was logged, such as adding or deleting calendars, events, guests, or subscriptions to event reminders and notifications. See Activity name descriptions for details.
Activity description Details of the event described in the Activity name field.
User User who triggered the logged action.
Calendar ID ID of the calendar where the logged action happened.
Event title Title of the calendar event.
Event ID ID of the calendar event.
Message ID ID of the email notification.
Recipient email Recipient of the email notification.
Remote EWS URL

The URL of the Exchange Web Services (EWS) endpoint. Available only when Calendar Interop is turned on.

Error code Error code associated with an unsuccessful request. Available only when Calendar Interop is turned on.
Requested window start Start of the time window for an availability lookup. Available only when Calendar Interop is turned on.
Requested window end End of the time window for an availability lookup. Available only when Calendar Interop is turned on.
API kind API through which the logged action was made. Options include:
  • Android (first- and third-party calendar applications)
  • CalDAV (usually Apple® devices)
  • Calendar API
  • Calendar for iOS®
  • Calendar Web
  • Gmail ICS Parser (event emails from other calendar systems)
  • Events from Gmail
  • EWS (used by Calendar Interop)
User agent User agent software associated with the calendar event.
Date Date and time the event occurred (displayed in your browser's default time zone).
IP address Internet Protocol (IP) address associated with the logged action. This might reflect the user’s physical location, but it can also be something else, such as a proxy server or a Virtual Private Network (VPN) address.
Activity name descriptions

Here are types of activity that are available under the Activity name column (see above):

Activity name Description
Calendar access level(s) changed Log entry for each time a calendar access level changes.
Calendar country changed Log entry for each time a calendar country changes.
Calendar created Log entry for each time a calendar is created.
Calendar deleted Log entry for each time a calendar is deleted.
Calendar description changed Log entry for each time a calendar description is changed.
Calendar location changed Log entry for each time a calendar location is changed.
Calendar time zone changed Log entry for each time a calendar time zone is changed.
Calendar title changed Log entry for each time a calendar title is changed.
Event created Log entry for each time an event is created.
Event deleted Log entry for each time an event is deleted.
Event guest added Log entry for each time a guest is added to an event.
Event guest removed Log entry for each time a guest is removed from an event.
Event guest response changed Log entry for each time a guest response changes for an event.
Event modified Log entry for each time an event is modified. This generic entry is only shown when no more specific action log entries are available.
Event removed from trash Log entry for each time an event is permanently removed from the calendar trash.
Event restored Log entry for each time an event is restored from the calendar trash.
Event start time changed Log entry for each time an event start time is changed.
Event title modified Log entry for each time an event title is modified.
Notification triggered Log entry for each time an email notification is triggered when a user is acting on an event or calendar. When this entry is selected, the following conditional fields will appear:

Notification type
Values:
- Event reminder
- New event
- Changed event
- Cancelled event
- Event response
- Daily agenda
- Calendar access request
- Calendar access granted
- Email guests
- Event ownership change

Allows filtering based on the type of email notification.
Recipient Allows filtering based on the notification recipient.
Subscription created Log entry for each time a subscription is created.
Subscription deleted Log entry for each time a subscription is deleted.
Successful availability lookup of a calendar on Exchange from Google

Log entry for each time a Calendar client successfully looks up availability information of an Exchange user.

Note: These logs are only available when Calendar Interop is turned on.

Successful availability lookup of a calendar on Google from Exchange

Log entry for each time an Exchange client successfully looks up availability information of a Calendar user.

Note: These logs are only available when Calendar Interop is turned on.

Unsuccessful availability lookup of a calendar on Exchange from Google

Log entry for each time a Calendar client is unsuccessful in looking up availability information of an Exchange user.

Note: These logs are only available when Calendar Interop is turned on.

Unsuccessful availability lookup of a calendar on Google from Exchange

Log entry for each time an Exchange client is unsuccessful in looking up availability information of a Calendar user.

Note: These logs are only available when Calendar Interop is turned on.

Step 3: Customize and export your audit log data

Filter the audit log data by user or activity

You can narrow your audit log to show specific events or users. For example, find all log events for when users created or deleted a calendar, or find all Calendar activity for a particular user.

  1. Open your Calendar audit log as shown above.
  2. If you don't see the Filters section, click Filter Filter.
  3. Enter or select the criteria for your filter. You can filter on any combination of the data you can view in the log.
  4. Click Search.

Export your audit log data

You can export your Calendar audit log data to a Google Sheet, or download it to a CSV file.

  1. Open your Calendar audit log as shown above.
  2. (Optional) To change the data to include in your export, on the toolbar, click Select columns Select columns.
  3. (Optional) Click the box next to each column with data you want to export, and click Apply.
  4. On the toolbar, click Download Download.

You can export up to 210,000 cells. The maximum number of rows depends on the number of columns you select.

How old is the data I'm seeing?

For details on exactly when data becomes available and how long it's retained, see Data retention and lag times.

Step 4: Set up email alerts

You can easily track specific Calendar activities by setting up alerts. For example, get an alert whenever someone creates or deletes a calendar.

  1. Open your Calendar audit log as shown above.
  2. If you don't see the Filters section, click Filter Filter.
  3. Enter or select the criteria for your filter. To set up an alert, you can filter on any combination of the data you can view in the log except date and time range.
  4. Click Set Alert.
  5. In the Set alert: Calendar box, enter a name for the alert.
  6. Check the box to deliver the alert to the account super administrators.
  7. Enter the email addresses of any other alert recipients.
  8. Click Save.

To edit your custom alerts, see Administrator email alerts.

Was this article helpful?
How can we improve it?
Sign in to your account

Get account-specific help by signing in with your G Suite account email address, or learn how to get started with G Suite.