The logged event action, such as View, Rename, Create, Edit, Apply Security Update, Import content, or Label removedĪddress from where the user performed the activity. Whether the file is client-side encrypted Unique Drive item identifier associated with the activity, as stored in the URL link for the fileįile format that the activity involves, such as Google Docs, Sheets, Slides, JPEG, PDF, PNG, MP4, Microsoft Word, Excel, PowerPoint, txt, HTML, MPEG audio, QuickTime video, folder, or shared drives Sometimes large uploads can take a while to log. Note: Most events are logged when they’re complete. (Essentials edition only) Whether the user action is a chargeable activityĭate and time the event occurred (displayed in your browser's default time zone) Target domain in case the audit log is for a visibility change Users external to the domain who start events are shown as anonymous, except when they view or edit a document explicitly shared with them (as an individual or as part of a specific group) Open the audit and investigation page Access Drive log event dataĮmail address of the user who performed the action. Drive audit events are logged only for files owned by users with supported editions.įor a full list of services and activities that you can investigate, such as Google Drive or user activity, read through the data sources for the audit and investigation page.

For details on when data becomes available and how long it's retained, go to Data retention and lag times.

If your Google Workspace edition supports it, you can use a new Reports API to access advanced Google Workspace reports data. You can use the Activity API to programmatically access basic reports data. There you can view a record of actions to see your organization's user activity in Drive. Drive log events include content your users create in Google Docs, Sheets, Slides, and other Google Workspace apps, and content that your users upload to Drive, such as PDFs and Microsoft Word files. For information about this change, go to Improved audit and investigation experience: What's new in Google Workspace.Īs an administrator, you can use the audit and investigation page to run searches related to Drive log events. The audit log page has been replaced with a new audit and investigation page.

Google drive sync log