Filter and export audit log data & create alerts

You can customize what you review for any audit log in your Google Admin console. You can also set up email alerts for certain activities.

Filter by user or activity

You can review specific events or user and admin activities.For example, you can create a filter to find all users who are using 2-Step Verification. Or you can create a filter to list people who share numerous external links.

Note: If filtering by user, use a valid email address, for example user@example.com.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Reports.
  3. On the left, under Audit, click an audit log.
  4. Click Add a filter.
  5. Select and enter the criteria for your filter and if needed, click Apply.

    For example, select Event name and then an event to see log entries for each time the event occurred.

Filter by organizational unit

To compare statistics between organizational units in a domain, you can filter by organizational unit. 

  1. At the top of the report, click Organizational unit"".
  2. Select an organizational unit and click Apply.

Important: When you filter by organizational unit, the results may show events from another organizational unit. This is because the events are filtered by the users who belong to this organizational unit or any of its child units.

For example, a user is a member of Organizational Unit A (OU-A). This user modifies a feature that affects a setting in Organizational Unit B (OU-B). If you apply a filter to the OU-B audit logs, this event doesn't show because the user who performed the modification was in OU-A. To see the event, either apply the filter to OU-A or do not use any OU filter.

Filter by group

Before you can filter audit log data by group, you need to add the group to a Filtering group.

Step 1: Add a group to the Filtering group

  1. At the top of the report, click Group filter "".
  2. Click Filtering groups.
    The Filtering groups page displays.
  3. Click Add Groups.
  4. Choose from the list of groups, or enter text to search for a group name.
  5. Click Addand thenSave.
    Note: After you add a group to the Filtering group, changes may take up to 24 hours to propagate.

Step 2: Filter audit log by group

  1. At the top of the report, click Group filter"".
  2. Select an organizational unit and click Apply.

Filter by date

  1. At the top of the report, click Date range"".
  2. Select a period from the list or enter a start and end date and time.
  3. If needed, click Apply.

You can only filter the current organizational unit hierarchy, even when searching for older data.

Export your audit log data

You can export a maximum of 100,000 rows to Google Sheets or a CSV file.

  1. Open your audit log as shown above.
  2. (Optional) To change the data to include in your export, click Manage columns "", select or remove the columns that you want to export, and click Save.
  3. Click Download "".
  4. Under Select columns, click Currently selected columns or All columns.
  5. Select a format and click Download.

Create email alerts

Track specific activities by setting up email alerts. Admin-email alerts are based on system defined rules on the security rules page. For example, get an alert whenever there’s a suspicious sign-in attempt.

  1. Open your audit log as shown above.
  2. Click Add a filter.
  3. Enter or select the criteria for your filter and click Create reporting rule "".
  4. Enter a name for the rule.
  5. (Optional) To send the alert to all super admins, under Recipients, click Turn on "".
  6. Enter the email addresses of the recipients and click Create.
Learn more about setting up and editing admin email alerts.
Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false