Drive log events

View user Google Drive file activity

Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more

As your organization's administrator, you can run searches and take action on Drive log events. For example, you can view a record of actions of your organization's user activity in Drive. Drive log events include content your users create in Google Docs, Sheets, Slides, and other Google Workspace apps, and content that your users upload to Drive, such as PDFs and Microsoft Word files.

You can use the Activity API to access basic reports data. If your Google Workspace edition supports it, you can use a new Reports API to access advanced Google Workspace reports data.

Important:

Not all activities in Drive are logged. For a list of what's included, go to Logged and unlogged events.
For details on when data becomes available and how long it's retained, go to Data retention and lag times.
Most Drive audit events are logged only for files owned by users with supported editions. However, URL Accessed events are logged when the user who starts an Apps Script script that accesses a URL is in your organization and has a supported edition.

Run a search for log events

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

Expand section | Collapse all & go to top

Audit and investigation tool

Security investigation tool

Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

To run a search in the security investigation tool, first choose a data source. Then, choose one or more conditions for your search. For each condition, choose an attribute, an operator, and a value.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Security center > Investigation tool.
Requires having the Security center administrator privilege.
Click Data source and select Drive log events.
Click Add Condition.
Tip: You can include one or more conditions in your search or customize your search with nested queries. For details, go to Customize your search with nested queries.
Click Attributeselect an option.
For a complete list of attributes, go to the Attribute descriptions section.
Select an operator.
Enter a value or select a value from the list.
(Optional) To add more search conditions, repeat steps 4–7.
Click Search.
You can review the search results from the investigation tool in a table at the bottom of the page.
(Optional) To save your investigation, click Save enter a title and descriptionclick Save.

Notes

In the Condition builder tab, filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
If you give a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.

Attribute descriptions

For this data source, you can use the following attributes when searching log event data:

Expand section | Collapse all & go to top

Attributes for searching log data

Note:

Not all attributes in the following list are reported for all events.
The following list is not exhaustive and is subject to change. For more details about Drive log events, go to Drive Audit Activity Events on the Google Workspace Admin SDK website.

Attribute	Description
Actor	Email address of the user who performed the action. Users external to the domain are shown as anonymous, except when they view or edit a document explicitly shared with them (as an individual or as part of a specific group). Note: When a user has both a primary email address and an alias address, the log event data records the primary email address even if an event, such as item sharing, involves the alias.
Actor group name	The group name of the actor. For more information, go to Filtering results by Google Group. To add a group to your filtering groups allowlist: Select Actor group name. Click Filtering groups. The Filtering groups page appears. Click Add Groups. Search for a group by entering the first few characters of its name or email address. When you see the group you want, select it. (Optional) To add another group, search for and select the group. When you finish selecting groups, click Add. (Optional) To remove a group, click Remove group . Click Save.
Actor organizational unit	Organizational unit of the actor
API method	The API method used by the action from Download and Item content accessed actions that occur through a third-party app, for example, drive.files.export.
App ID	OAuth client ID of the third-party app that performed the action
App name	The app that performed the action
Audience	Target domain in case the audit log is for a visibility change
Billable	(Essentials edition only) Whether the user action is a chargeable activity
Date	Date and time the event occurred (displayed in your browser's default time zone) Note: Most events are logged when they’re complete. Sometimes large uploads can take a while to log.
Document ID	Unique Drive item identifier associated with the activity, as stored in the URL link for the file Note: This is only reported for certain actions for URL Accessed events, document ID and other file-related fields, such as document type and owner. For details, go to URL Accessed.
Document type	File format that the activity involves, such as Docs, Sheets, or Slides, JPEG, PDF, PNG, MP4, Microsoft Word, Excel, PowerPoint, txt, HTML, MPEG audio, QuickTime video, folder, or shared drives
Domain*	The domain where the action occurred
Encrypted*	Whether the file is client-side encrypted
Event name	Events such as View, Rename, Create, Edit, Print, Delete, Upload, and Download Most actions are logged immediately. However, Print events in the Drive viewer can be delayed 12 hours or more from the time of the event. Files that are deleted by Drive or emptied from Trash are logged. Other events, such as uploading a file, are logged once they’re complete.
Impersonation	An application used domain-wide delegation to make a request on a user's behalf. True indicates that the event was performed on a user's behalf. You can review Actor to find the user’s email and App ID and App name to identify the application. Learn more about domain-wide delegation.
IP address*	The address where the user performed the activity. This might be the user's physical location, but it can be a proxy server or a Virtual Private Network (VPN) address. No IP addresses are logged for events: Started by users external to the domain From services that don't log the IP address in their requests Relating to renaming or deleting a shared drive
New publish visibility value	New visibility of the document
New value*	New value of the changed setting
New value IDs*	New value of the label field
Old publish visibility value	Old visibility of the document if the activity is a visibility change
Old value*	Old value of the changed setting
Old value IDs*	Old value of the label field
Owner	User who owns the file
Prior visibility	Previous visibility of the document in case visibility is changed
Recipients*	Email addresses of the recipients
Shared drive ID	The Drive ID of the shared drive containing the file. If the file is not in a shared drive, this field isn't populated.
Target	User whose access is changed
Title	Title of the document
Visibility	Visibility of the Drive item associated with the activity
Visibility change	Visibility of the Drive item before the activity
Visitor	Yes means that the activity is from a non-Google user. No means that the activity is from a Google user. Learn more about sharing documents with visitors.

* You cannot create reporting rules with these filters. Learn more about reporting rules versus activity rules.

Note: If you gave a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.