Show Event Activity on Files, Folders or Shared Drives Across Google Drive

Show Event Activity on Files, Folders, or Shared Drives Across Google Drive #

Google Drive automatically records every Google Drive event – such as file changes and collaboration actions – in a log that helps track exactly what happened.

Below are some questions and answers that can help you understand where the data is.

• Where is this event log? 
  • Event logs are found within the Google Workspace Admin console. But they are also found on the activity tab of any file or folder within a user’s Google Drive app. 
• For how long is it stored before being deleted?
  • Event logs, or as Google calls them, audit event logs, are kept for 6 months.
• Who has access to it? 
  • Any user who appears as a Manager, Content Manager, Owner, or Contributor on a file or folder will be able to see the event logs. Or a Google Workspace super admin within the Google Admin console can see the audit event logs. 

How-to video #

GAT+ Retention Policy #

When GAT+ is installed, it scans the Drive Event logs (Audit event logs) of each file and folder going back 6 months. Then, going forward, it never deletes audit event logs unless your GAT+ license has expired for longer than 30 days. 

The Audit event logs of each file and folder are retained indefinitely, but not all actions are recorded by GAT+.

Sometimes we summarize sets of event actions or ignore them because they are not important. 

We ignore Audit event logs:  

• Approval canceled
• Approval Requested
• Approval reviewer change
• Approval reviewer responded
• Approval completed
• Approval decisions reset
• Approval due time change
• Label applied
• Label applied on creation
• Label field value changed
• Label removed

We summarize Audit event logs: 

• We compress some download events: from anonymous actors on popular files publicly shared, and we only store at most one download event per file per hour.

Event Activity on Folders #

In the Drive audit section of the tool, the Admins can view and audit all the Files and Folders of the entire Drive of the domain.

Navigate to GAT+ > Drive > Files > Apply filter and search for the folder needed.

How to Search for the Shared Drive Folder #

In the example below, we will search for the Shared Drive folder.

Navigate to Drive > Files > Apply custom filter

In the Files tab, filter enter the search parameters as below – ( any different filter can be applied to find the files/folders needed )

As an example: 

• Flag equal Shared Drive
• Type equal Folder
• Title equal – enter the title 

Click on Apply to view the result.

When the result is displayed, select the Folder by clicking on the arrow beside the title, and from the menu, select “Show content of folder and its subfolders.”

Show events #

If we just select ‘Show events’ will show the events in the folder itself.

To view the events of the content of the folder itself, we need to go inside the folder.

View the content of the folder and subfolders #

The result will display all the content of the selected Folder.

Note: The filter will show – Contents of the folder (and its subfolders) with ID: 0APw… (the folder selected)

Click on the Events tab at the top (2)  

View the events in the folder and subfolders #

The events audit will display the event types of the previously applied search.

In GAT+ > Drive > Events, apply the custom filter and search

In the Type – select Filtered files search (Selects events for the files matching the filter set in the Files tab and then applies the filter definition below)

Click on the Apply button

The result will give us all the events for this specific Shared Drive folder.

The default date range is the last 7 days. This allows you to view the Events data for the set time frame.

The options available are

• Today
• Yesterday 
• Last 7, 14, 28 days
• This month
• Last month
• Last year 
• Custom – allowing you to select data from 5 years ago onwards 

Additional Filters #

Additional filters can be applied under the Definition list as below

• Email – equal to the user needed
• Event – select a specific event 
  • In the example:  – User X and all downloads from the Shared Drive folder

Export data #

We can also export the data as a Google Spreadsheet and investigate it further in detail.

Event Activity on Files #

In the Drive audit section of the tool, the Admins can view and audit all the Files and Folders of the entire Drive of the domain.

#

Navigate to GAT+ > Drive > Files > Apply filter and search for the files needed

• Click on the arrow beside the title of the file
• Click on the “show events” button (3)

The result will display all events that occurred in the file, like:

• Shared drive membership change
• Document access scope change
• Visibility change
• ACL Change
• Contributors can’t share
• Change owner
• Download
• Upload
• Edit
• Print
• View
• Create
• Copy
• Move
• Delete
• Rename
• Preview
• Add to Folder
• Remove from Folder
• Trash
• Untrash
• Sheets Import Range
• Email as attachment
• Label Added
• Label in new file
• label removed
• Label Field Changed
• Published Change
• Unknow

The default date range is the last 7 days. This allows you to view the Events data for the set time frame.

The options available are

• Today
• Yesterday 
• Last 7, 14, 28 days
• This month
• Last month
• Last year 
• Custom – allowing you to select data from 5 years ago onwards 

Set up a scheduled report  #

Apply a filter and search for specific events (for example).

Set up as a scheduled report.

• Scheduled – set up a Scheduled report 
• Occurrence – select the time when the report is to be triggered 

FAQ #

1. What are the key filters I can apply to audit the Events of Drive files and folders?

• Answer: You can apply various filters in the Drive > Files or Drive > Events tabs of GAT+ to pinpoint specific data.
  • To find files/folders: Use filters like Flag equal Shared Drive, Type equal Folder, or Title equal (enter the specific title).
  • To find events: Use filters under the Definition list, such as:
    • Email: Equal to a specific user’s email address.
    • Event: Select a specific action like Download, Edit, View, Move, or Delete.
• To search content in events: For the events of an entire folder and its subfolders, first find the folder in the Files tab, and then apply the Filtered files search option in the Events tab.

2. How do I export the filtered audit data, and what are the export options?

• Answer: You can export the filtered data directly from the GAT+ interface for further investigation.
  • Action: After applying your desired filter and viewing the result, click the Export data button.
  • Options: The data can be exported as a Google Spreadsheet or a CSV file.
    • Note: For very large reports (more than 150,000 records), it’s recommended to choose the CSV format or use the Scheduled Report feature to process it in the background.

3. How can I set up a report to run automatically on a recurring basis?

• Answer: You can turn any filtered search result into a scheduled report in GAT+.
  • Process:
    • Apply your chosen filter and search (e.g., all ‘Download’ events by User X).
    • Select the Scheduled option within the report setup.
  • Set the Occurrence (the time/frequency) for when you want the report to be automatically triggered (e.g., Every day, Last week, Last month, or a custom schedule).
• This ensures the audit data you need is regularly generated and sent without manual intervention.