Drive audit log (Google Apps Unlimited)
This feature is available only with Google Apps Unlimited or Google Apps for Education.
The Drive audit log lists every time your domain's users view, create, preview, print, update, delete, download, or share Drive content. This includes content you create in Google Docs, Sheets, Slides, and other Google Apps, as well as content created elsewhere that you upload to Drive, such as PDFs and Word files.
To access the Drive audit log, sign in to your Admin console and click Reports > Audit > Drive. The page displays the following information:
- Event Description—A summary of the event, such as "Larry created an item."
- User—The user who performed the activity.
- Date—The date the event occurred (displayed in your domain's default timezone).
- Event Name—The action the user performed, such as View, Create, or Edit.
- IP Address—The IP address from where the user performed the activity.
- File Type—The type of Drive file the activity involves.
- Owner—The user who owns the file.
Use the Filters section at the side to configure the page to only display data that meets certain criteria. For example, the page can show events of a particular type, or events that occurred during a specific date range.
You can also use the Filters section to create and configure a custom alert. Custom alerts do not use the Date Range. Choose an event name from the drop-down list and your other filters, then click the Set Alert button. In the Set alert: window you can add a custom alert name, check the Super Administrator(s) box, or add additional recipient user emails. After you configure your custom alert click the Save button. To edit your custom alerts, refer to Account activity alerts.
Note the following:
- If you don't see the Filters section, click
.
- Each entry in the log links to the file associated with the event.
- No IP addresses are logged for events initiated by users external to the domain.
- Users external to the domain who initiate events are shown as anonymous.
- No IP addresses are logged for events from services that don't log the IP address in their requests.
- When you copy files, the type of action logged in the Drive audit logs depends on the file type:
- Copy Google Docs: "Create", "Edit", and "View" are logged
- Copy Google Sheets: "Create", and "Edit" are logged
- Copy Google Slides: "Create", and "Edit" are logged
- Copy any MS Office format or non Google format files: "Create" only is logged
- To change the columns the log displays, click
. The page remembers the columns you choose and shows the same ones the next time you sign in.
- The log shows near real-time data (as recent as the last few minutes) and keeps data from up to six months ago.
- Exported Google Sheets and downloaded CSV files both show a maximum of 10,000 rows.
- Domains with any version of Google Apps can use the Activity API to programmatically access basic Google Apps reports data, while domains with Google Apps Unlimited can use a new Reports API to access advanced Google Apps reports data.
Known Issues
- The log shows downloads of web preview events, but reports on these events can be delayed for up to 12 hours.
- The log shows preview events that occurred in the Drive viewer and print events that occurred in the Drive viewer and the Google Docs editors, but reports on these events may be delayed up to 12 hours from the time of the event.
- The log may show print events as download events when printing files with the Drive application from iOS or Android devices.
- The log may show print events as download events when printing slide or sheet files with the Drive web UI.
- Downloads from the following sources are not logged:
- Google Drive for Mac/PC sync client downloads
- Google Takeout downloads
- Downloads to offline browser caches
- Docs printed from the Drive web UI
- Photos that are synced to, downloaded from, or viewed through Google Photos
- Drive items that are emailed as attachments and downloaded through the recipient's email client
