Notification

Duet AI is now Gemini for Google Workspace. Learn more

About the audit and investigation tool

In your Google Admin console, you can use the audit and investigation page to review user and administrator activity in your organization. You can use the information to track users and admins, and for security purposes.

The availability of features on the audit and investigation page depends on your Google Workspace or Cloud Identity edition. See the sections below for details about the different data sources that are available.

Note: If you have a premium edition such as Enterprise Plus or Education Plus, you have access to the more advanced features of the security investigation tool. The investigation tool enables super admins to identify, triage, and take action on security and privacy issues. For more details, go to About the security investigation tool.

Choose a data source to get started

To access data about log events on the audit and investigation page, at the left of your Admin console, click Reportingand thenAudit and investigationand thenthen select your data source.

Data source Description
Admin log events View admin activity in the Google Admin console
Calendar log events View and track changes to user events in Google Calendar
Chat log events Track user conversations and room activity
Chrome log events View Chrome events for your organization 
Chrome Sync log events View a record of actions by users who have Chrome Sync enabled
Classroom log events View common activities, such as who removed a student from a class or archived a class
Note: You must be a Google Workspace for Education admin to access Classroom log events
Cloud Search log events View user actions in Cloud Search
Contacts log events View Contacts activity in the Google Admin console
Devices log events Review activities on your organization’s devices
Directory Sync log events View events related to Directory Sync
Drive log events View user Google Drive activity
Graduation log events Track user data transfer
Groups Enterprise log events See Admin console actions on groups and group memberships
Groups log events View user changes to groups in Google Groups
Jamboard log events Track changes to Jamboards
Keep log events Track activity on notes owned by users in your organization
Looker Studio log events View users' actions in Looker Studio
Meet log events Understand users' video-meeting activity
Meet recordings in Drive audit & export Track users' Meet recording activity
OAuth log events Track third-party app usage and data-access requests
Password Vaulted Apps log events See admin and user activity related to password vaulted apps
Profile log events View user Profile activity
Rule log events Track your users' attempts to share sensitive data
SAML log events View your users' sign-ins to SAML applications
Secure LDAP log events Review LDAP operations for the Secure LDAP service
Takeout log events View user Google Takeout activity
Tasks log events View user actions related to tasks, task lists, and recurring tasks
User log events View user activity across their accounts. Note: The User log events data source provides data previously contained in the Login audit log and User accounts audit log.
Vault log events Review user activity in Google Vault
Voice log events Review user activity in Google Voice

 

When and how long is data available?

Go to Data retention and lag times.

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
17642085190837412076
true
Search Help Center
true
true
true
true
true
73010
false
false