Run a search in the audit and investigation tool

Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more

In the Google Admin console, you can use the audit and investigation tool to review user and administrator activity in your organization. See the table below for details about the available data sources.

Choose a data source to get started

To access data about log events on the audit and investigation tool, at the left of your Admin console, click Reportingand thenAudit and investigationand thenthen select your data source.

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

Data source Description
Admin log events View admin activity in the Google Admin console
Calendar log events View and track changes to user events in Google Calendar
Chat log events Track user conversations and room activity
Chrome log events View Chrome events for your organization 
Chrome Sync log events View a record of actions by users who have Chrome Sync enabled
Classroom log events View common activities, such as who removed a student from a class or archived a class
Note: You must be a Google Workspace for Education admin to access Classroom log events
Cloud Search log events View user actions in Cloud Search
Contacts log events View Contacts activity in the Google Admin console
Devices log events Review activities on your organization’s devices
Directory Sync log events View events related to Directory Sync
Drive log events View user Google Drive activity
Graduation log events Track user data transfer
Groups Enterprise log events See Admin console actions on groups and group memberships
Groups log events View user changes to groups in Google Groups
Jamboard log events Track changes to Jamboards
Keep log events Track activity on notes owned by users in your organization
Looker Studio log events View users' actions in Looker Studio
Meet log events Understand users' video-meeting activity
Meet recordings in Drive audit & export Track users' Meet recording activity
OAuth log events Track third-party app usage and data-access requests
Password Vaulted Apps log events See admin and user activity related to password vaulted apps
Profile log events View user Profile activity
Rule log events Track your users' attempts to share sensitive data
SAML log events View your users' sign-ins to SAML applications
Secure LDAP log events Review LDAP operations for the Secure LDAP service
Takeout log events View user Google Takeout activity
Tasks log events View user actions related to tasks, task lists, and recurring tasks
User log events View user activity across their accounts. Note: The User log events data source provides data previously contained in the Login audit log and User accounts audit log.
Vault log events Review user activity in Google Vault
Voice log events Review user activity in Google Voice

 

When and how long is data available?

Go to Data retention and lag times.

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
953192751263235059
true
Search Help Center
true
true
true
true
true
73010
false
false