Setting up distance learning? Learn how

Classroom audit log

View user activity for Google Classroom files

Important: You must be a Google Workspace for Education user to access Classroom audit logs.

Classroom audit logs let administrators find what was changed within an organization in the Admin Console. With audit logs, you can:

  • Look up common activities, such as who removed a student from a class or archived a class
  • Troubleshoot common user scenarios 

Classroom audit logs are available for all Google Workspace for Education users.

Which events are logged?

Important: ACTOR_IDENTIFIER and impacted_users are email values.

Name

Parameters

Description

Notes

Course Membership Events

user_joined_course

  • course_id
  • course_title
  • course_role
  • course_join_method
  • event_source

{ACTOR_IDENTIFIER} joined {course_title} in role: {course_role}

In this event, the actor is the student, not the teacher, so there’s no impacted_users parameter.

user_removed_from_course

  • course_id
  • course_title
  • impacted_users
  • course_role
  • event_source

{ACTOR_IDENTIFIER} removed user(s) from {course_title} (previous role: {course_role})

This doesn't include uninviting a student or teacher.

user_invited_to_course

  • course_id
  • course_title
  • impacted_users
  • course_role

{ACTOR_IDENTIFIER} invited user(s) to join {course_title} in role: {course_role}

user_added_to_course

  • course_id
  • course_title
  • impacted_users
  • course_role

{ACTOR_IDENTIFIER} added user(s) to {course_title} in role: {course_role}

Course Events

deleted_course

  • course_id
  • course_title
  • event_source

{ACTOR_IDENTIFIER} deleted {course_title}

created_course

  • course_id
  • course_title
  • event_source

{ACTOR_IDENTIFIER} created {course_title}

This includes copying from a current course.

archived_course

  • course_id
  • course_title

{ACTOR_IDENTIFIER} archived {course_title}

restored_course

  • course_id
  • course_title

{ACTOR_IDENTIFIER} restored {course_title}

Coursework Events

published_course_work

  • course_id
  • course_title
  • post_id
  • course_work_title
  • course_work_type

{ACTOR_IDENTIFIER} published course work ‘{course_work_title}’ in {course_title}

published_announcement

  • course_id
  • course_title
  • post_id

{ACTOR_IDENTIFIER} published an announcement in {course_title}

changed_submission_state

  • course_id
  • course_title
  • post_id
  • course_work_title
  • impacted_users
  • is_late
  • has_grade
  • submission_state

{ACTOR_IDENTIFIER} changed the state of submission(s) for course work ‘{course_work_title}’ in {course_title}. New state: {submission_state}

commented_announcement

  • course_id
  • course_title
  • post_id

{ACTOR_IDENTIFIER} made a comment on an announcement in {course_title}

commented_course_work

  • course_id
  • course_title
  • post_id
  • course_work_title
  • course_work_type

{ACTOR_IDENTIFIER} made a comment on course work ‘{course_work_title}’ in {course_title}

commented_submission_public

  • course_id
  • course_title
  • post_id
  • course_work_title
  • course_work_type
  • impacted_users

{ACTOR_IDENTIFIER} made a public comment on a submission for course work ‘{course_work_title}’ in {course_title}

An “Impacted user” is the student who owns the submission.

commented_submission_private

  • course_id
  • course_title
  • post_id
  • course_work_title
  • course_work_type
  • impacted_users

{ACTOR_IDENTIFIER} made a private comment on a submission for course work ‘{course_work_title}’ in {course_title}

An “Impacted user” is the student who owns the submission.

Which fields are available on Classroom audit logs?

The Classroom audit log provides the following information:

Data type Description
Timestamp Date and time of the event displayed in your browser's default time zone
Event name Logged event or action
Event description Details of the event
Impacted users List of impacted email addresses
Course ID Course’s unique identifier
Post ID ID associated with the related stream item
Course work type Type of course work on which the event happened
Is late Assignment marked as on time or late
Has grade Grade reported or not
Event source Origin of where the event happened
IP address (Not visible to users) The IP address used to sign in. Usually the address is the user's physical location. It can also be a proxy server or a Virtual Private Network (VPN) address.
Which filters are available for Classroom audit logs?

Search filters available in the Audit Log in the Admin Console include:

  • Organizational unit
  • Group filter
  • Date range
  • Event name
  • User name
  • Course ID
  • Course name
  • Post ID
  • Course work title
  • Impacted users
  • Event source
  • IP address

Learn how to filter and export log data and create alerts.

When and how long is data available?

Related resources

Was this helpful?
How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
Search Help Center
false