--- title: Show Event Activity on Files, Folders or Shared Drives Across Google Drive description: "## Show Event Activity on Files, Folders, or Shared Drives Across Google Drive Google Drive automatically records every Google Drive event - such as file changes and collaboration actions - in a log that helps track exactly what happened. Below…" url: "https://gatlabs.com/knowledge/tech-tips/show-event-activity-on-files-folders-or-shared-drives-across-google-drive/" updated: "2025-11-27" category: "Drive Audit & Management" tags: - GAT+ --- # Show Event Activity on Files, Folders or Shared Drives Across Google Drive ## Show Event Activity on Files, Folders, or Shared Drives Across Google Drive Google Drive automatically records every Google Drive event - such as file changes and collaboration actions - in a log that helps track exactly what happened. Below are some questions and answers that can help you understand where the data is. - Where is this event log?  - Event logs are found within the Google Workspace Admin console. But they are also found on the activity tab of any file or folder within a user's Google Drive app.  - For how long is it stored before being deleted? - Event logs, or as Google calls them, audit event logs, are kept for 6 months. - Who has access to it?  - Any user who appears as a Manager, Content Manager, Owner, or Contributor on a file or folder will be able to see the event logs. Or a Google Workspace super admin within the Google Admin console can see the audit event logs.  ### How-to video [https://www.youtube.com/embed/pRdt71whN4A?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1](https://www.youtube.com/embed/pRdt71whN4A?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1) ### GAT+ Retention Policy When GAT+ is installed, it scans the Drive Event logs (Audit event logs) of each file and folder going back **6 months**. Then, going forward, it **never** deletes audit event logs unless your GAT+ license has expired for longer than 30 days.  The Audit event logs of each file and folder are retained **indefinitely,** but not all actions are recorded by GAT+. Sometimes we summarize sets of event actions or ignore them because they are not important.  We ignore [Audit event logs](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive#approval_completed):   - Approval canceled - Approval Requested - Approval reviewer change - Approval reviewer responded - Approval completed - Approval decisions reset - Approval due time change - Label applied - Label applied on creation - Label field value changed - Label removed We summarize Audit event logs:  - We compress some [download](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive#download) events: from anonymous actors on popular files publicly shared, and we only store at most one download event per file per hour. ### Event Activity on Folders In the Drive audit section of the tool, the Admins can view and audit all the Files and Folders of the entire Drive of the domain. Navigate to **GAT+ > Drive > Files > Apply filter** and search for the **folder** needed. #### How to Search for the Shared Drive Folder In the example below, we will search for the Shared Drive folder. Navigate to **Drive > Files > Apply custom filter** In the **Files** tab, filter enter the search parameters as below - ( any different filter can be applied to find the files/folders needed ) As an example:  - **Flag** equal **Shared Drive** - **Type** equal **Folder** - **Title** equal - enter the title  ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-17_30_44-.png) Click on **Apply**to view the result. When the result is displayed, select the Folder by clicking on the arrow beside the title, and from the menu, select "**Show content of folder and its subfolders."** ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-17_33_11-.png) #### Show events If we just select 'Show events' will show the **events in the folder itself.** To **view the events of the content of the folder itself, we need to go inside the folder.** #### View the content of the folder and subfolders The result will display all the content of the selected Folder. **Note:** The filter will show - **Contents of the folder (and its subfolders) with ID:** 0APw... (the folder selected) Click on the **Events **tab at the top (2)   ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-17_37_49-.png) #### View the events in the folder and subfolders The **events** audit **will display the event types of the previously applied search.** In **GAT+ > Drive > Events**, apply the custom filter and search In the **Type** - select **Filtered files search **(Selects events for the files matching the filter set in the Files tab and then applies the filter definition below) Click on the **Apply **button ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-17_47_37-.png) The result will give us **all the events** for this **specific Shared Drive folder.** ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-17_50_28-.png) The default date range is the last 7 days. This allows you to view the Events data for the set time frame. The options available are - Today - Yesterday  - Last 7, 14, 28 days - This month - Last month - Last year  - Custom - allowing you to select data from **5 years ago** onwards  #### Additional Filters Additional filters can be applied under the Definition list as below - **Email** - equal to the user needed - **Event** - select a specific event  - In the example:  - User X and all downloads from the Shared Drive folder ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-18_22_22-.png) #### Export data We can also export the data as a Google Spreadsheet and investigate it further in detail. ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-18_32_43-Greenshot.png) ### Event Activity on Files In the Drive audit section of the tool, the Admins can view and audit all the Files and Folders of the entire Drive of the domain. ## Navigate to **GAT+ > Drive > Files > Apply filter** and search for the **files** needed - Click on the **arrow** beside the **title of the file** - Click on the "**show events**" button (3) ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-18_39_52-.png) The result will display**all events** that **occurred in the file,** like: - Shared drive membership change - Document access scope change - Visibility change - ACL Change - Contributors can't share - Change owner - Download - Upload - Edit - Print - View - Create - Copy - Move - Delete - Rename - Preview - Add to Folder - Remove from Folder - Trash - Untrash - Sheets Import Range - Email as attachment - Label Added - Label in new file - label removed - Label Field Changed - Published Change - Unknow The **default date range is the last 7 days**. This allows you to view the Events data for the set time frame. The options available are - Today - Yesterday  - Last 7, 14, 28 days - This month - Last month - Last year  - Custom - allowing you to select data from **5 years ago** onwards  ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-18_43_26-.png) ### Set up a scheduled report  Apply a filter and search for specific events (for example). Set up as a scheduled report. - **Scheduled** - set up a Scheduled report  - **Occurrence** - select the time when the report is to be triggered  ![](https://gatlabs.com/knowledge/wp-content/uploads/2022/08/2025-11-26-18_55_57-.png) ### FAQ **1. What are the key filters I can apply to audit the Events of Drive files and folders?** - **Answer:** You can apply various filters in the **Drive > Files** or **Drive > Events** tabs of GAT+ to pinpoint specific data. - **To find files/folders:** Use filters like **Flag equal Shared Drive**, **Type equal Folder**, or **Title equal** (enter the specific title). - **To find events:** Use filters under the **Definition** list, such as: - **Email:** Equal to a specific user's email address. - **Event:** Select a specific action like **Download**, **Edit**, **View**, **Move**, or **Delete**. - **To search content in events:** For the events of an entire folder and its subfolders, first find the folder in the **Files** tab, and then apply the **Filtered files search** option in the **Events** tab. **2. How do I export the filtered audit data, and what are the export options?** - **Answer:** You can export the filtered data directly from the GAT+ interface for further investigation. - **Action:** After applying your desired filter and viewing the result, click the **Export data** button. - **Options:** The data can be exported as a **Google Spreadsheet** or a **CSV** file. - Note: For very large reports (more than 150,000 records), it's recommended to choose the CSV format or use the Scheduled Report feature to process it in the background. **3. How can I set up a report to run automatically on a recurring basis?** - **Answer:** You can turn any filtered search result into a scheduled report in GAT+. - **Process:** - Apply your chosen **filter and search** (e.g., all 'Download' events by User X). - Select the **Scheduled** option within the report setup. - Set the **Occurrence** (the time/frequency) for when you want the report to be automatically triggered (e.g., Every day, Last week, Last month, or a custom schedule). - This ensures the audit data you need is regularly generated and sent without manual intervention.