Because of lag time, some reports and search results in the security investigation tool and audit and investigation page might not show the latest data. Additionally, log event data is retained for specific time periods before it's no longer available.
The sections below show how long it can take before data is available for various reports and log events, and how long data is retained.
Important: There's a small chance that reports and log event data for some events will be delayed beyond the specified times below. In rare cases, events might not be reported.
Lag times
The lag times in these tables show how long it can take before data for specific Admin console reports and log events is available.
Log events data
The following lag times are for log events data related to the audit and investigation page and security investigation tool.
| Log events name | Lag time |
|---|---|
| Access Transparency log events | Near real time (couple of minutes) |
| Admin log events | Near real time (couple of minutes) |
| Assignments log events | Near real time (couple of minutes) |
| Calendar log events | Tens of minutes (can also go up to a couple of hours) |
| Chat log events | 1–3 days |
| Chrome log events | Near real time (couple of minutes) |
| Classroom log events | 1–3 days |
| Context Aware Access log events | Near real time (couple of minutes) |
| Currents log events | 1–3 days |
| Devices log events | Near real time (couple of minutes) |
| Directory Sync log events | Near real time (couple of minutes) |
| Drive log events | Near real time (couple of minutes) |
| Email log events | Near real time (under 10 minutes) |
| Gmail log events | Near real time (couple of minutes) |
| Groups log events | Tens of minutes (can also go up to a couple of hours) |
| Jamboard log events | Near real time (couple of minutes) |
| Keep | Near real time (couple of minutes) |
| LDAP log events | Near real time (couple of minutes) |
| Login log events | Up to a few hours |
| Looker Studio log events | Near real time (couple of minutes) |
| Meet log events | Near real time (couple of minutes) |
| Meet quality | Near real time (couple of minutes) |
| OAuth | Up to a few hours |
| Rules log events | Near real time |
| SAML log events | Up to a few hours |
| Secure LDAP log events | 1–3 days |
| Takeout log events |
Event when Takeout process starts: Near real time Event when the Takeout process finishes: Depends on the size of the data, up to many days |
| Token log events | A couple of hours |
| User accounts | Tens of minutes |
| Voice log events | Near real time |
Retrieving report or log events data for older dates or a wide time range might take so long that, by the time results are available, the most recent log data might no longer be fresh. For tools that require real-time monitoring, use a short time range.
Many products listed above (such as Gmail and Google Drive) are relevant for Google Workspace only, and not for other Google services, such as Cloud Identity.
Highlight reports
| Report name | Lag time |
|---|---|
| Calendar report | 1–3 days |
| Classroom report | 1–3 days |
| Currents report | 1–3 days |
| Drive report (related to Document link shared status) | 1–3 days |
| Drive report | 1–3 days |
| Gmail report | 1–3 days |
| Hangouts report | 1–3 days |
Security reports
| Report name | Lag time |
|---|---|
| 2-Step Verification Enrollment report | 1–3 days |
| External apps report | 1–3 days |
| External shares report | 1–3 days |
| Internal shares report | 1–3 days |
Aggregate reports
| Report name | Lag time |
|---|---|
| Accounts report | 1–3 days |
| Apps Script report | 1–3 days |
| Apps and extension usage report (related to Chrome) | 1–3 days |
| Version report (related to Chrome) | 1–3 days |
| Currents report | 1–3 days |
| Drive report | 1–3 days |
| Gmail report | 1–3 days |
| Google Chat report | 1–3 days |
| Mobile report | 1–3 days |
Apps usage activity
| Report name | Lag time |
|---|---|
| Drive storage used report | 1–3 days |
| Files added report | 1–3 days |
| Files edit report | 1–3 days |
| Files viewed report | 1–3 days |
| Gmail storage used report | 1–3 days |
| Google Sheets added report | 1–3 days |
| Photo storage used report | 1–3 days |
| Total storage used report | 1–3 days |
Data retention
Note: For reports and log events data not mentioned here, the retention time is generally 6 months.
You can access log events data and reports data this far back:
| Log events data or report name | Data retention time |
|---|---|
| Access Transparency log events data | 6 months |
| Account activity reports | 6 months |
| Admin log events data | 6 months |
| Assignments log events data | 6 months |
| Audit data retrieved using the API | 6 months |
| Calendar log events data | 6 months |
| Chat log events data | 6 months |
| Chrome apps and extension usage report | 12 months (also configurable by admin) |
| Chrome log events data | 6 months |
| Chrome version report | 12 months (also configurable by admin) |
| Classroom log events data | 6 months |
| Context-aware access log events data | 6 months |
| Currents log events data | 6 months |
| Customer/User usage data retrieved using the API | 15 months |
| Devices log events data (availability of these logs depends on your subscription) | 6 months |
| Drive log events data (availability of these logs depends on your subscription) | 6 months |
| Email log search | 30 days |
| Entities usage data retrieved using the API | 30 days |
| Groups log events data | 6 months |
| Keep log events data | 6 months |
| Jamboard log events data (availability of these logs depends on your subscription) | 6 months |
| Looker Studio log events data | 6 months |
| Meet log events data | 6 months |
| Meet quality tool | 30 days (Meetings older than 28 days are not displayed in the Admin Console) |
| OAuth Token log events data (availability of these logs depends on your subscription) | 6 months |
| Rules log events data | 6 months |
| SAML log events data | 6 months |
| Security reports | 6 months |
| Users | 6 months |
| User log events data (previously named Login audit log) | 6 months |
| Voice log events data | 6 months |
