Drive log events

View user Google Drive file activity

Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more

As your organization's administrator, you can run searches and take action on Drive log events. For example, you can view a record of actions of your organization's user activity in Drive. Drive log events include content your users create in Google Docs, Sheets, Slides, and other Google Workspace apps, and content that your users upload to Drive, such as PDFs and Microsoft Word files.

You can use the Activity API to access basic reports data. If your Google Workspace edition supports it, you can use the Reports API to access advanced Google Workspace reports data.

Important:

  • Not all activities in Drive are logged. For a list of what's included, go to Logged and unlogged events.
  • For details on when data becomes available and how long it's retained, go to Data retention and lag times.
  • Most Drive audit events are logged only for files owned by users with supported editions. However, URL Accessed events are logged when the user who starts a Google Apps Script script that accesses a URL is in your organization and has a supported edition.

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

Audit and investigation tool

To run a search for log events, first choose a data source. Then choose one or more filters for your search.

  1. In the Google Admin console, go to Menu and then Reporting and then Audit and investigation and then Drive log events.

    Requires having the Audit & Investigation administrator privilege.

  2. To filter events that occurred before or after a specific date, for Date, select Before or After. By default, events from the last 7 days are shown. You can select a different date range or click to remove the date filter.

  3. Click Add a filter and then select an attribute. For example, to filter by a specific event type, select Event.
  4. Select an operator and then select a value and then click Apply.
    • (Optional) To create multiple filters for your search, repeat this step.
    • (Optional) To add a search operator, above Add a filter, select AND or OR.
  5. Click Search. Note: Using the Filter tab, you can include simple parameter and value pairs to filter the search results. You can also use the Condition builder tab, where the filters are represented as conditions with AND/OR operators.

Security investigation tool

Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

To run a search in the security investigation tool, first choose a data source. Then, choose one or more conditions for your search. For each condition, choose an attribute, an operator, and a value.

  1. In the Google Admin console, go to Menu and then Security and then Security center and then Investigation tool.

    Requires having the Security center administrator privilege.

  2. Click Data source and select Drive log events.

  3. To filter events that occurred before or after a specific date, for Date, select Before or After. By default, events from the last 7 days are shown. You can select a different date range or click to remove the date filter.

  4. Click Add Condition.
    Tip: You can include one or more conditions in your search or customize your search with nested queries. For details, go to Customize your search with nested queries.
  5. Click Attribute and then select an option. For example, to filter by a specific event type, select Event.
    For a complete list of attributes, go to the Attribute descriptions section.
  6. Select an operator.
  7. Enter a value or select a value from the list.
  8. (Optional) To add more search conditions, repeat the steps.
  9. Click Search.
    You can review the search results from the investigation tool in a table at the bottom of the page.
  10. (Optional) To save your investigation, click Save and then enter a title and description and then click Save.

Notes

  • In the Condition builder tab, filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
  • If you give a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.
  • You can only search for data in messages that have not yet been deleted from Trash.

Attribute descriptions

For this data source, you can use the following attributes when searching log event data.

Attributes for searching log data

Note:

  • Not all attributes in the following list are reported for all events.
  • The following list is not exhaustive and is subject to change. For more details about Drive log events, go to Drive Audit Activity Events on the Google Workspace Admin SDK website.
Attribute Description
Actor

Email address of the user who performed the action. Users external to the domain are shown as anonymous, except when they view or edit a document explicitly shared with them (as an individual or as part of a specific group).

Note: When a user has both a primary email address and an alias address, the log event data records the primary email address even if an event, such as item sharing, involves the alias.
Actor group name

The group name of the actor. For more information, go to Filtering results by Google Group.

To add a group to your filtering groups allowlist:

  1. Select Actor group name.
  2. Click Filtering groups.
    The Filtering groups page appears.
  3. Click Add Groups.
  4. Search for a group by entering the first few characters of its name or email address. When you see the group you want, select it.
  5. (Optional) To add another group, search for and select the group.
  6. When you finish selecting groups, click Add.
  7. (Optional) To remove a group, click Remove group .
  8. Click Save.
Actor organizational unit Organizational unit of the actor
Agent info

Details about the agent or flow that took the action.

Click an entry to open the Log details panel and show:

  • Agent ID—Unique ID of the flow
  • Agent name—Display name of the flow
  • Agent product—Service used by the agent or flow. For flows, it will be Workspace Studio

Note: The agent context in Drive audit logs will not always be written.
API method The API method used by the action from Download and Item content accessed actions that occur through a third-party app, for example, drive.files.export.
App ID OAuth client ID of the third-party app that performed the action
App name The app that performed the action
Audience Target domain in case the audit log is for a visibility change
Billable (Essentials edition only) Whether the user action is a chargeable activity
By an agent Whether the action was by a flow or agent (true or false)
Date

Date and time the event occurred (displayed in your browser's default time zone)

Note: Most events are logged when they're complete. Sometimes large uploads can take a while to log.
Document ID

Unique Drive item identifier associated with the activity, as stored in the URL link for the file

Note: This is only reported for certain actions for URL Accessed events, document ID and other file-related fields, such as document type and owner. For details, go to URL Accessed.
Document type File format that the activity involves, such as Docs, Sheets, or Slides, Gems, JPEG, PDF, PNG, MP4, Microsoft Word, Excel, PowerPoint, TXT, HTML, MPEG audio, QuickTime video, folder, or shared drives
Domain* The domain where the action occurred
Encrypted* Whether the file is client-side encrypted
Event name

Events such as View, Rename, Create, Edit, Print, Delete, Upload, and Download

Most actions are logged immediately. However, Print events in the Drive viewer can be delayed 12 hours or more from the time of the event. Files that are deleted by Drive or emptied from Trash are logged. Other events, such as uploading a file, are logged once they're complete.
Impersonation

An application used domain-wide delegation to make a request on a user's behalf. True indicates that the event was performed on a user's behalf. You can review Actor to find the user's email and App ID and App name to identify the application.

Learn more about domain-wide delegation.
IP address*

The address where the user performed the activity. This might be the user's physical location, but it can be a proxy server or a Virtual Private Network (VPN) address.

No IP addresses are logged for events:

  • Started by users external to the domain
  • From services that don't log the IP address in their requests
  • Relating to renaming or deleting a shared drive
IP ASN

You need to add this column to the search results. For the steps, go to Manage search results column data.

IP Autonomous System Number (ASN), subdivision, and region associated with the log entry.

To review the IP ASN and subdivision and region code where the activity happened, click the name in the search results.
New publish visibility value New visibility of the document
New value* New value of the changed setting
New value IDs* New value of the label field
Old publish visibility value Old visibility of the document if the activity is a visibility change
Old value* Old value of the changed setting
Old value IDs* Old value of the label field
Owner User who owns the file
Prior visibility Previous visibility of the document in case visibility is changed
Recipients* Email addresses of the recipients
Resources Details about the files, folders, or rules associated with the action.

To search by these details, select Resources from the menu, then select a nested column: Resource ID, Resource title, Resource type, or Owner details.

Results are shown in the Resources column. Click an entry to open the Log details panel to show:
  • Resource ID—The resource identifier
  • Resource title—Title of the resource
  • Resource type—Category of the resource (such as Google Drive, email, or rule)
  • Resource relation—Relationship of the resource to the event
  • Owner details—Details about the resource owner, including owner type and owner identity
  • Resource label—The classification labels applied to the resource
  • Resource label field—The specific fields and data types within a label

If you export this information to a comma-separated values (CSV) file or Google Sheets, the information is saved as a single block of text within a cell.

Resource label Details about the classification labels assigned to a resource.

To search by this information, select Resource label from the menu, then select a nested column: Resource label ID or Resource label title.

Results are shown in the Resources column. Click an entry to open the Log details panel.
Resource label field Details about the specific fields within a classification label.

To search by these fields, select Resource label field from the menu, then select a nested column: Label field ID, Label field name, or Label field type.

Results are shown in the Resources column. Click an entry to open the Log details panel.
Resource label field value Details about the data entered into a specific label field.

To search by these values, select Resource label field value from the menu, then select a nested column: Date, Number, Selection, Selection list, Text, User, or User list.

Results are shown in the Resources column. Click an entry to open the Log details panel.
Shared drive ID The Drive ID of the shared drive containing the file. If the file is not in a shared drive, this field isn't populated.
Target User whose access is changed
Title Title of the document
User device ID

You need to add this column to the search results. For the steps, go to Manage search results column data.

Details about the device that performed the action.

In the search results, click User device ID to show:

  • User device ID—The device's unique identifier
  • User device type—The type of device used (such as DESKTOP_MAC or DESKTOP_WINDOWS)
  • User device OS version—The operating system version installed on the device

If you export this information to a comma-separated values (CSV) file or Google Sheets, the information is saved as a single block of text within a cell.

Visibility Visibility of the Drive item associated with the activity
Visibility change Visibility of the Drive item before the activity
Visitor Yes means that the activity is from a non-Google user. No means that the activity is from a Google user. Learn more about sharing documents with visitors.
* You can't create reporting rules with these filters. Learn more about reporting rules versus activity rules.

Note: If you gave a user a new name, you won't see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you won't see results for events related to OldName@example.com.

View files shared outside of a domain

Audit and investigation page

  1. Open the log events as described in Run a search for log events.
  2. Click Add a filter and then Visibility and then select Shared externally.
  3. Click Search.

If you turn off external sharing and a user shares a resource with a group that allows external users, data is marked Shared externally in the log. However, external users in the group can't access the shared resource. And, you'll see this even if the group doesn't have any external users.

Security investigation tool

  1. In the Google Admin console, go to Menu and then Security and then Security center and then Investigation tool.

    Requires having the Security center administrator privilege.

  2. Click Data source and then select Drive log events.
  3. Click Add Condition.
  4. Click Attribute and then select Visibility.
  5. Click Contains and then select Is.
  6. Click Visibility and then select Shared externally.
  7. Click Search.
    You can review the search results from the investigation tool in a table at the bottom of the page.

If you turn off external sharing and a user shares a resource with a group that allows external users, data is marked Shared externally in the log. However, external users in the group can't access the shared resource. And, you'll see this even if the group doesn't have any external users.

Logged and unlogged events

Delete

Files that are automatically deleted by Drive or emptied from Trash are logged.

Copy

When a file is copied, Create and Copy events are logged for the new file, and a Source Copy event is logged for the original file.

When a user outside of your organization copies a file to an external location, your organization doesn't log the Create and Copy events because the new file is external. However, your logs have the Source Copy event on the original file with a Copy Type of External. To monitor when data is copied out of your organization, you can review Source Copy events that have an External copy type.

Print

Print events aren't recorded when a user prints a file opened in a Google file format (Docs, Sheets, Slides, Drawings, and Forms).

When printing files with the Drive app from an Apple iPhone and iPad or Android device, Print events might be logged as Download events.

Download

Most downloads are logged, including when files are copied between Drive and a local device using Google Drive for desktop.

The following View actions are logged as Download events:

  • Previewing a file in the Drive app on a mobile device
  • Previewing a file, such as a PDF, that can't be directly opened in Docs or other Google apps
  • Sending a file as an attachment to an email from a Google app, such as Docs

Downloads from the following sources are not logged:

  • Google Takeout downloads (search Takeout log events instead)
  • Downloads to offline browser caches
  • Photos that are synced to, downloaded from, or viewed using Google Photos
  • Drive items that are emailed from Gmail as attachments

Item content synced

Item content synced events are logged in the following cases and are available for activity after July 1, 2024:

  • A file is synced from Drive to a local device using Drive for desktop. These are also logged as Download events.
  • A file is synced to a device for offline access, including ongoing syncs with the online version. Item content synced events to the Drive mobile app (Android and iOS) can be logged as Download events instead.

Item content prefetched

Item content prefetched events indicate that a Google app retrieved Drive data but did not immediately show it to the user. For example, previewing a file in Drive can lead to prefetching of nearby files. The content is available for the user if it's needed later.

Item content accessed

You can access files on behalf of users through an app that uses a Google Workspace API such as the Google Drive API or Google Sheets API. These actions aren't logged as Download or View events, only as Item content accessed. Gemini's Item content accessed events are logged only when file content is accessed outside of a user's open file in Drive for web.

Item content access events aren't logged when a file is viewed or opened by a user in Drive for web, Drive on mobile, or the Drive for desktop app.

View

Viewing files using the /htmlview, /embed, /revisions, and other special URLs are logged as View events.

URL Accessed