Data retention and lag times
You may find that your Admin console reports and audit logs are not fully populated with the latest data. Keep in mind reports do not reflect real-time data, and some reports may take longer to display updated information.
Note: Many of the categories listed below (such as Gmail and Drive) are relevant for G Suite only, and not for other Google services such as Cloud Identity.
Lag times
The lag times in this table reflect how long it takes before collected data tied to specific Admin console reports and audit logs is available to view.
| Item name | Report name | Lag time |
|---|---|---|
| Highlights | ||
| Gmail | Gmail report | 1–3 days |
| Drive | Drive report | 1–3 days |
| Hangouts | Hangouts report | 1–3 days |
| Google+ | Google+ report | 1–3 days |
| Calendar | Calendar report | 1–3 days |
| Document Link Shared Status | Drive report | 1–3 days |
| Security | ||
| External Link Shared Files | Drive report | 1–3 days |
| External Link Shared Files | Security report | 1–3 days |
| Less Secure Apps Access | Security report | 1–3 days |
| 2-Step Verification Enrollment | 2SV report | 1–3 days |
| Aggregate reports | ||
| Accounts | Accounts report | 1–3 days |
| Gmail | Gmail report | 1–3 days |
| Drive | Drive report | 1–3 days |
| Google+ | Google+ report | 1–3 days |
| Mobile | Mobile report | 1–3 days |
| Apps usage activity | ||
| Files added | Drive report | 1–3 days |
| Total Emails | Gmail report | 1–3 days |
| Total Storage Used (MB) | Quota report | 1–3 days |
| Audit | ||
| Admin | Admin audit | near real time (couple of minutes) |
| Login | Login audit | 1–2 days |
| Drive | Drive audit | near real time (couple of minutes from completion of an event) |
| Calendar | Calendar audit | tens of minutes (can also go up to a couple of hours) |
| Google+ | Google+ audit | near real time (couple of minutes) |
| Mobile devices | Devices audit | near real time (couple of minutes), up to 4 hours, if updated at next sync. |
| SAML | SAML audit | near real time (couple of minutes), up to 3 hours, if updated at next sync. |
| LDAP | LDAP audit | near real time (couple of minutes) |
| Token | Token audit | a couple of hours |
| Groups | Groups audit | tens of minutes (can also go up to a couple of hours) |
| User accounts | User accounts audit | tens of minutes |
| Email log search | Email audit | near real time (couple of minutes) |
Retrieving report or audit log data for very old dates or large time ranges may take so much time that once results are available the most recent log entry may no longer be fresh. For applications that require real-time log monitoring use a small time range.
How long is data saved?
You're able to access saved Admin console audit logs and reports data this far back:
|
Audit log or report name |
Data retention time |
|---|---|
| Admin audit log | 6 months |
| Calendar audit log | 6 months |
| Google+ audit log | 6 months |
| OAuth Token audit log | 6 months |
| Devices audit log (G Suite Business +) | 6 months |
| SAML audit log | 6 months |
| Drive audit log (G Suite Business +) | 6 months |
| Email log search | 30 days |
| Account activity reports | 6 months |
| Security reports | 6 months |
| Groups audit log | 6 months |
| User accounts audit log | 6 months |
| Audit data retrieved using the API | 6 months |
| Customer/User usage data retrieved using the API | 15 months |
| Entities usage data retrieved using the API | 30 days |
For any audit log or report not mentioned above the retention time should be 6 months.
