Calendar audit log

Track calendar notifications and view changes to your users’ calendars, events, and subscriptions

This feature isn't available in the legacy free or Government edition of G Suite, or Drive Enterprise. (Compare editions)

You can track changes to calendars, events, and subscriptions in your Google Calendar audit log. You can also track the email notifications associated with these actions in the audit log. This information is helpful when you troubleshoot issues or when your users notice discrepancies or unexpected changes to their calendars, shared calendars, or specific calendar events. Log entries usually appear within one half-hour of the user action.

Note: Calendar audit log entries show data for the previous 6 months of data. Support will not have access to information before that time.

Step 1: Open your Calendar audit log

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Reports.

    To see Reports, you might have to click More controls at the bottom.

  3. On the left, under Audit, click Calendar.
  4. (Optional) Next to the columns, click Manage columns Manage columns and select the columns that you want to see or hide.

Step 2: Understand Calendar audit log data

Data you can view
Data Type Description
Activity name The action that was logged, such as adding or deleting calendars, events, guests, or subscriptions to event reminders and notifications. For details, see Activity name descriptions.
Activity description Details of the event described in the Activity name field.
User User who triggered the logged action.
Calendar ID ID of the calendar where the logged action happened.
Event title Title of the calendar event.
Event ID ID of the calendar event.
Message ID ID of the email notification.
Recipient email Recipient of the email notification.
Remote EWS URL

The URL of the Exchange Web Services (EWS) endpoint. Available only when Calendar Interop is turned on.

Error code Error code associated with an unsuccessful request. Available only when Calendar Interop is turned on.
Requested window start Start of the time window for an availability lookup. Available only when Calendar Interop is turned on.
Requested window end End of the time window for an availability lookup. Available only when Calendar Interop is turned on.
API kind API through which the logged action was made. Options include:
  • Android (first- and third-party calendar applications)
  • CalDAV (usually Apple® devices)
  • Calendar API
  • Calendar for iOS®
  • Calendar Web
  • Gmail ICS Parser (event emails from other calendar systems)
  • Events from Gmail
  • EWS (used by Calendar Interop)
User agent User agent software associated with the calendar event.
Date Date and time the event occurred (displayed in your browser's default time zone).
IP address Internet Protocol (IP) address associated with the logged action. Usually reflects the user's physical location, but could be a proxy server or a virtual private network (VPN) address.
Activity name descriptions

Here are types of activity that are available under the Activity name column.

Activity name Description
Calendar access level(s) changed Log entry for each time a calendar access level changes.
Calendar country changed Log entry for each time a calendar country changes.
Calendar created Log entry for each time a calendar is created.
Calendar deleted Log entry for each time a calendar is deleted.
Calendar description changed Log entry for each time a calendar description is changed.
Calendar location changed Log entry for each time a calendar location is changed.
Calendar time zone changed Log entry for each time a calendar time zone is changed.
Calendar title changed Log entry for each time a calendar title is changed.
Event created Log entry for each time an event is created.
Event deleted Log entry for each time an event is deleted.
Event guest added Log entry for each time a guest is added to an event.
Event guest removed Log entry for each time a guest is removed from an event.
Event guest response changed Log entry for each time a guest response changes for an event.
Event modified Log entry for each time an event is modified. This generic entry is only shown when no more specific action log entries are available.
Event removed from trash Log entry for each time an event is permanently removed from the calendar trash.
Event restored Log entry for each time an event is restored from the calendar trash.
Event start time changed Log entry for each time an event start time is changed.
Event title modified Log entry for each time an event title is modified.
Notification triggered Log entry for each time an email notification is triggered when a user is acting on an event or calendar. When this entry is selected, the following conditional fields will appear:

Notification type
Values:
- Event reminder
- New event
- Changed event
- Cancelled event
- Event response
- Daily agenda
- Calendar access request
- Calendar access granted
- Email guests
- Event ownership change

Allows filtering based on the type of email notification.
Recipient Allows filtering based on the notification recipient.
Subscription created Log entry for each time a subscription is created.
Subscription deleted Log entry for each time a subscription is deleted.
Successful availability lookup of a calendar on Exchange from Google

Log entry for each time a Calendar client successfully looks up availability information of an Exchange user.

Note: These logs are only available when Calendar Interop is turned on.

Successful availability lookup of a calendar on Google from Exchange

Log entry for each time an Exchange client successfully looks up availability information of a Calendar user.

Note: These logs are only available when Calendar Interop is turned on.

Unsuccessful availability lookup of a calendar on Exchange from Google

Log entry for each time a Calendar client is unsuccessful in looking up availability information of an Exchange user.

Note: These logs are only available when Calendar Interop is turned on.

Unsuccessful availability lookup of a calendar on Google from Exchange

Log entry for each time an Exchange client is unsuccessful in looking up availability information of a Calendar user.

Note: These logs are only available when Calendar Interop is turned on.

Step 3: Customize and export your audit log data

Filter the audit log data by user or activity

You can narrow your audit log to show specific events or users. For example, find all log events for when users created or deleted a calendar, or find all Calendar activity for a particular user.

  1. Open your Calendar audit log as shown above.
  2. Click Add a filter.
  3. Select and enter the criteria for your filter and if needed, click Apply.
  4. (Optional) To filter by organizational unit, at the top right, click Organization filter, select the organizational unit, and click Apply.
  5. (Optional) To specify a date range to search, click Date range and select a period from the list or enter a start and end date and time. If needed, click Apply.

Note: In some cases the User Agent or API log entry might be blank or show "unknown" as the value. Non-Google clients (for example, ;Mac OSX®) sometimes populate the logs in separate batches, which might cause some log entries not to appear as expected. Try adjusting the date range filter to find the event information and the User Agent data.

Filter by organizational unit

You can filter by organizational unit to compare statistics between child organizations in a domain.

  1. Open your report as shown above.
  2. At the top, click Organization filter.
  3. Select an organizational unit and click Apply.

Filter by date

  1. Open your report as shown above.
  2. At the top, click Date range.
  3. Select a period from the list or enter a start and end date and time.
  4. If needed, click Apply.

You can only filter the current organization hierarchy, even when searching for older data. Data before December 20, 2018 will not appear in the filtered results.

Export your audit log data

You can export your audit log data to Google Sheets or download it to a CSV file.

  1. Open your audit log as shown above.
  2. (Optional) To change the data to include in your export, click Manage columns Manage columns, select or remove the columns that you want to export, and click Save.
  3. Click Download Download.
  4. Under Select columns, click Currently selected columns or All columns.
  5. Under Select format, click Google Sheets or comma-separated values (CSV).
  6. Click Download.

You can export a maximum of 100,000 rows to Sheets or CSV.

How old is the data I'm seeing?

For details on exactly when data becomes available and how long it's retained, see Data retention and lag times.

Step 4: Set up email alerts

Track specific Calendar activities by setting up alerts. For example, get an alert whenever someone creates or deletes a calendar.

  1. Open your Calendar audit log as shown above.
  2. Click Add a filter.
  3. Enter or select the criteria for your filter and click Create Alert.
  4. Enter a name for the alert.
  5. (Optional) To send the alert to all super administrators, under Recipients, click Turn on Turn on.
  6. Enter the email addresses of alert recipients.
  7. Click Create.

To edit your custom alerts, see Administrator email alerts.

Was this helpful?
How can we improve it?