Login audit log

This feature is not available in the legacy free edition of Google Apps.

The Login audit log lets you track Web-based logins in your domain, and see which logins were successful, unsuccessful, or suspicious.

To access the Login audit log, sign in to your Admin console, click Reports, and click Login in the left menu under Audit. The page displays the following information:

  • Event Description—A summary of the login event, including whether it was successful.
  • IP Address—The internet protocol (IP) address used by the user to sign in.
  • Date—The date the event occurred (displayed in your domain's default timezone).
  • Login Type—Indicates whether the user signed in with a Google password or via single sign-on (SSO).

Use the Filters section at the side to configure the page to only display data that meets certain criteria. For example, the page can show events of a particular type, or events that occurred during a specific date range.

You can also use the Filters section to create and configure a custom alert. Custom alerts do not use the Date Range. Choose an event name from the drop-down list and your other filters, then click the SET ALERT button. In the Set alert: window you can add a custom alert name, check the Super Administrator(s) box, or add additional recipient user emails. After you configure your custom alert click the SAVE button. To edit your custom alerts, refer to Account activity alerts.

Note the following:

  • If you don't see the Filters section, click filter.
  • To change the columns the log displays, click column picker. The page remembers the columns you choose and shows the same ones the next time you sign in.
  • The log shows data from as recent as the last few hours, and from as far back as six months ago.

 

Respond to suspicious login activity

If you see suspicious login activity:

  1. Contact the users with suspicious logins, and ask them if they remember signing in when the suspicious login occurred. They can check their last account activity if they're unsure.
  2. If you can't establish the legitimacy of the login, follow the Google apps Admin Security Checklist. Pay special attention to administrator login activity.
  3. As a precaution, we encourage you to reset the password of any account that has suspicious activity.
  4. If you determine the suspicious activity is actually a legitimate login but you keep getting alerts for this user, consider enrolling the user in 2-step verification, which will reduce inaccurate suspicious login notifications. We recommend enrolling all of your users in 2-step verification.
Was this article helpful?