Data retention and lag times
You might find that your Admin console reports and audit logs don’t show the latest data, because reports don’t reflect real-time data. Some reports might take longer to display updated information.
Note: Many products listed below (such as Gmail and Google Drive) are relevant for G Suite only, and not for other Google services, such as Cloud Identity.
Lag times
The lag times in this table show how long it can take before data for specific Admin console reports and audit logs is available.
| Item name | Report name | Lag time |
|---|---|---|
| Highlights | ||
| Gmail | Gmail report | 1–3 days |
| Drive | Drive report | 1–3 days |
| Hangouts | Hangouts report | 1–3 days |
| Google+ | Google+ report | 1–3 days |
| Calendar | Calendar report | 1–3 days |
| Document Link Shared Status | Drive report | 1–3 days |
| Security | ||
| External Link Shared Files | Drive report | 1–3 days |
| External Link Shared Files | Security report | 1–3 days |
| Less Secure Apps Access | Security report | 1–3 days |
| 2-Step Verification Enrollment | 2SV report | 1–3 days |
| Aggregate reports | ||
| Accounts | Accounts report | 1–3 days |
| Gmail | Gmail report | 1–3 days |
| Drive | Drive report | 1–3 days |
| Google+ | Google+ report | 1–3 days |
| Mobile | Mobile report | 1–3 days |
| Apps usage activity | ||
| Files added | Drive report | 1–3 days |
| Total Emails | Gmail report | 1–3 days |
| Total Storage Used (MB) | Quota report | 1–3 days |
| Audit | ||
| Admin | Admin audit | 1–3 days |
| Login | Login audit | 1–2 days |
| Drive | Drive audit | near real time (couple of minutes) |
| Calendar | Calendar audit | tens of minutes (can also go up to a couple of hours) |
| Jamboard | Jamboard audit | 1–3 days |
| Google+ | Google+ audit | 1–3 days |
| Chat | Chat audit | 1–3 days |
| Meet | Meet audit | near real time (couple of minutes) |
| Voice | Voice audit | 1–3 days |
| Mobile devices | Devices audit | near real time (couple of minutes), up to 4 hours, if updated at next sync |
| SAML | SAML audit | near real time (couple of minutes), up to 3 hours, if updated at next sync |
| LDAP | LDAP audit | 1–3 days |
| Token | Token audit | a couple of hours |
| Groups | Groups audit | tens of minutes (can also go up to a couple of hours) |
| User accounts | User accounts audit | tens of minutes |
| Access Transparency | Access Transparency audit | near real time (couple of minutes) |
| Email log search | Email audit | 1–3 days |
Retrieving report or audit log data for older dates or a wide time range might take so long that, by the time results are available, the most recent log data might no longer be fresh. For tools that require real-time monitoring, use a short time range.
How long is data saved?
You can access Admin console audit logs and reports data this far back:
|
Audit log or report name |
Data retention time |
|---|---|
| Admin audit log | 6 months |
| Calendar audit log | 6 months |
| Jamboard audit log | 6 months |
| Google+ audit log | 6 months |
| OAuth Token audit log | 6 months |
| Devices audit log (G Suite Business +) | 6 months |
| SAML audit log | 6 months |
| Drive audit log (G Suite Business +) | 6 months |
| Email log search | 30 days |
| Account activity reports | 6 months |
| Security reports | 6 months |
| Groups audit log | 6 months |
| Chat audit log | 6 months |
| Meet audit log | 6 months |
| Voice audit log | 6 months |
| User accounts audit log | 6 months |
| Access Transparency | 6 months |
| Audit data retrieved using the API | 6 months |
| Customer/User usage data retrieved using the API | 15 months |
| Entities usage data retrieved using the API | 30 days |
For any report or audit log not mentioned here, the retention time is 6 months.
