Data retention and lag times

Reports, security investigation tool, & audit and investigation page

Because of lag time, some reports and search results in the security investigation tool and audit and investigation page might not show the latest data. Additionally, log event data is retained for specific time periods before it's no longer available. Administrators cannot delete log event data or change the length of time that the data is available for. 

The following sections show how long it can take before data is available for various reports and log events and how long data is retained.

Important: There's a small chance that reports and log event data for some events will be delayed beyond the following specified times. In rare cases, events might not be reported.

Lag times

Lag times indicate the delay between when a log event occurs and when the data for that event is available in Admin console reports and log events.

The following lag times apply to log events data from the audit and investigation page, security investigation tool, alert center, and the Admin SDK Reports API.

Users can view security events in the alert center, and they can also use the Reports API to obtain activity and usage reports.

Log events name Lag time
Access Transparency log events Near real time (couple of minutes)
Admin log events Near real time (couple of minutes)
Admin Data Action log events Near real time (couple of minutes)
Assignments log events Near real time (couple of minutes)
Calendar log events Tens of minutes (can also go up to a couple of hours)
Chat log events Near real time (couple of minutes)
Chrome log events Near real time (couple of minutes)
Classroom log events Near real time (couple of minutes)
Cloud Search log events Up to a few hours
Context Aware Access log events Near real time (couple of minutes)
Devices log events Near real time (couple of minutes)
Directory Sync log events Near real time (couple of minutes)
Drive log events Near real time (couple of minutes)
Gmail log events Near real time (couple of minutes)
Groups log events Tens of minutes (can also go up to a couple of hours)
Jamboard log events Near real time (couple of minutes)
Keep Near real time (couple of minutes)
LDAP log events Near real time (couple of minutes)
Looker Studio log events Near real time (couple of minutes)
Meet hardware log events Near real time (couple of minutes)
Meet log events Near real time (couple of minutes)
Meet quality Near real time (couple of minutes)
OAuth Up to a few hours
Rules log events Near real time
SAML log events Near real time (couple of minutes)
Takeout log events

Event when Takeout process starts: Near real time

Event when the Takeout process finishes: Depends on the size of the data, up to many days

Tasks log events Near real time (couple of minutes)
Token log events A couple of hours
User log events Login events: Up to a few hours
User account events: Tens of minutes
Vault log events Near real time (couple of minutes)
Voice log events Near real time

Retrieving report or log events data for older dates or a wide time range might take so long that by the time results are available, the most recent log data might no longer be fresh. For tools that require real-time monitoring, use a short-time range.

Many products previously listed above (such as Gmail and Google Drive) are relevant for Google Workspace only, and not for other Google services, such as Cloud Identity.

Highlight reports

Report name Lag time
Calendar report 1–3 days
Classroom report 1–3 days
Drive report (related to Document link shared status) 1–3 days
Drive report 1–3 days
Gmail report 1–3 days
Hangouts report 1–3 days

Security reports

Report name Lag time
2-Step Verification Enrollment report 1–3 days
External apps report 1–3 days
External shares report 1–3 days
Internal shares report 1–3 days

Aggregate reports

Report name Lag time
Accounts report 1–3 days
Apps Script report 1–3 days
Apps and extension usage report (related to Chrome) 1–3 days
Version report (related to Chrome) 1–3 days
Drive report 1–3 days
Gmail report 1–3 days
Google Chat report 1–3 days
Mobile report 1–3 days

Apps usage activity

Report name Lag time
Drive storage used report 1–3 days
Files added report 1–3 days
Files edit report 1–3 days
Files viewed report 1–3 days
Gmail storage used report 1–3 days
Google Sheets added report 1–3 days
Photo storage used report 1–3 days
Total storage used report 1–3 days

Data retention

Note: For reports and log events data not mentioned here, the retention time is generally 6 months.

You can access log events data and reports data this far back:

Log events data or report name Data retention time
Access Transparency log events data 6 months
Account activity reports 6 months
Admin log events data 6 months
Admin Data Action log events data 6 months
Assignments log events data 6 months
Audit data retrieved using the API 6 months
Calendar log events data 6 months
Chat log events data 6 months
Chrome apps and extension usage report 12 months 
Chrome log events data 6 months
Chrome version report 12 months 
Classroom log events data 6 months
Cloud Search log events data 6 months
Context-aware access log events data 6 months
Customer/User usage data retrieved using the API 15 months
Devices log events data (availability of these logs depends on your subscription) 6 months
Drive log events data 6 months
Email log search 30 days
Entities usage data retrieved using the API 30 days
Gmail log events 6 months
Groups log events data 6 months
Keep log events data 6 months
Jamboard log events data 6 months
Looker Studio log events data 6 months
Meet hardware log events data 6 months
Meet log events data 6 months
Meet quality tool 30 days (Meetings older than 28 days are not displayed in the Admin Console)
OAuth Token log events data 6 months
Rules log events data 6 months
SAML log events data 6 months
Security reports 6 months
Tasks log events data 6 months
Users 6 months
User log events data (previously named Login audit log) 6 months
Vault log events Indefinite
Voice log events data 6 months

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
2902535639322066214
true
Search Help Center
true
true
true
true
true
73010
false
false