When a user copy files, the type of action that’s logged depends on the file type: Other events, such as uploading a file, are logged once they’re complete. The types of actions on Drive items that can involve external domains are reported in the Drive audit logs of both domains are moving, copying, and changing access.įiles that are automatically deleted by Google Drive or emptied from Trash are logged. Names of external documents are not included in audit log entries. Some of these events are reported in the Drive audit logs of both your domain and the external domain. Some events involve domains outside your own for example, when a user copies a file to another domain. And, you’ll see Shared externally even if the group doesn’t have any external users. However, external users in the group can’t access the shared resource. If you turn off external sharing and a user shares a resource with a group that allows external users, data is marked Shared externally in the log. The sharing permissions change event won't appear in the log event data until the invitee creates an account and opens the file. If you share a file with someone outside your domain who doesn’t have a Google Account, the invitee must create a Google Account to access the file.
Learn more about sharing documents with visitors. No means that the activity is by a Google user. Yes means that the activity is by a non-Google user. Visibility of the Drive item before the activity Visibility of the Drive item associated with the activity Previous visibility of the document in case visibility is changed Old visibility of the document if the activity is a visibility change Relating to renaming or deleting a shared drive.From services that don't log the IP address in their requests.Started by users external to the domain.This might reflect the user's physical location, but it can be something else like a proxy server or a Virtual Private Network (VPN) address. The logged event action, such as View, Rename, Create, Edit, Apply Security Update, Import content, or Label removedĪddress from where the user performed the activity. Whether the file is client-side encrypted Unique Drive item identifier associated with the activity, as stored in the URL link for the fileįile format that the activity involves, such as Google Docs, Sheets, Slides, JPEG, PDF, PNG, MP4, Microsoft Word, Excel, PowerPoint, txt, HTML, MPEG audio, QuickTime video, folder, or shared drives Sometimes large uploads can take a while to log. Note: Most events are logged when they’re complete. (Essentials edition only) Whether the user action is a chargeable activityĭate and time the event occurred (displayed in your browser's default time zone) Target domain in case the audit log is for a visibility change
Users external to the domain who start events are shown as anonymous, except when they view or edit a document explicitly shared with them (as an individual or as part of a specific group) Open the audit and investigation page Access Drive log event dataĮmail address of the user who performed the action.
#PREVIEW MAC OS SHARE COLUMN MISSING OF MAIL APPS FULL#
Drive audit events are logged only for files owned by users with supported editions.įor a full list of services and activities that you can investigate, such as Google Drive or user activity, read through the data sources for the audit and investigation page.For details on when data becomes available and how long it's retained, go to Data retention and lag times.If your Google Workspace edition supports it, you can use a new Reports API to access advanced Google Workspace reports data. You can use the Activity API to programmatically access basic reports data. There you can view a record of actions to see your organization's user activity in Drive. Drive log events include content your users create in Google Docs, Sheets, Slides, and other Google Workspace apps, and content that your users upload to Drive, such as PDFs and Microsoft Word files.
For information about this change, go to Improved audit and investigation experience: What's new in Google Workspace.Īs an administrator, you can use the audit and investigation page to run searches related to Drive log events. The audit log page has been replaced with a new audit and investigation page.
0 kommentar(er)
