Show Event Activity on Files, Folders or Shared Drives Across Google Drive

Introduction #

Within the Google Workspace Google Drive, as your users interact with files or folders and collaborate with other users, they are generating a log of events. This event log is really helpful to see changes made to files and folders and what those changes were. 

Now you might be wondering where this event log is? For how long it is stored before being deleted? Who has access to it? 

1. Event logs are found within the Google Workspace Admin console. But they are also found on the activity tab of any file or folder within a user’s Google Drive app. 
2. Event logs or as Google calls them audit event logs are kept for 6 months. See details. 
3. Any user who appears as a Manager, Content Manager, Owner, Contributor on a file or folder will be able to see the event logs. Or a Google Workspace super admin within the Google admin console can see the audit event logs. 

How-to video #

GAT+ Retention Policy #

When GAT+ is installed it stores the retrospect Event logs (Audit event logs) of each file and folder going back 6 months. Then going forward it never deletes audit event logs unless your GAT+ license has expired longer than 30 days. 

The Audit event logs of each file and folder is retained indefinitely but not all actions are recorded by GAT+. Sometimes we summarize sets of event actions or ignore them because they are not important. 

We ignore Audit event logs:  

• Approval canceled
• Approval Requested
• Approval reviewer change
• Approval reviewer responded
• Approval completed
• Approval decisions reset
• Approval due time change
• Label applied
• Label applied on creation
• Label field value changed
• Label removed

We summarize Audit event logs: 

• We compress some download events: from anonymous actors on popular files publicly shared, and we only store at most one download event per file per hour.

Event Activity on Folders #

In the Drive audit section of the tool, the Admins can view and audit all the Files and Folders of the entire Drive of the domain.

Navigate to GAT+ > Drive > Files > Apply filter and search for the folder needed.

How to Search for the Shared Drive Folder #

In the example below, we will search for the Shared drive Folder.

Navigate to Drive > Files > Apply custom filter

In the Files tab, filter enter the search parameters as below – ( any different filter can be applied to find the files/folders needed )

As an example: 

• Flag equal Shared Drive
• Type equal Folder
• Title equal – enter the title 

Click on Apply and the result will be displayed.

Show content of Folder and its subfolder #

Once the result is displayed, view its content.

Click on the Title (arrow button) > Show content of this folder and its subfolders

Note: if we just select ‘Show events’ will show the events to the folder itself. To see events of the content of the folder itself we need to go inside the folder

View – the content of folder and subfolders #

The result will display all the content of the selected Folder.

Note: The filter will show – Contents of the folder (and its subfolders) with ID: 0APw… (the folder selected))

Click on the Events tab on the top.  

View – event of folder and subfolders #

The events audit will display the event types of the (previous applied) search.

• Selecting the “Events” tab will show us one page with the events that occurred to the Folder/File.
• Click on the filter button again and change the type of the filter to Filtered Files search

View all events on the Shared Drive folder #

This will give us all the events for this specific Shared drive folder.

Clicking on the Date value will filter by the newest event that has occurred on the folder.

Additional Filters #

Additional filters can be applied:

• Email – equal to the user needed
• Event – select a specific event 
  • In the example:  – User X and all downloads from the Shared Drive folder

We can also export the data as a Google Spreadsheet and investigate in further detail.

Event Activity on Files #

In the Drive audit section of the tool, the Admins can view and audit all the Files and Folders of the entire Drive of the domain.

#

Navigate to GAT+ > Drive > Files > Apply filter and search for the files needed

• Click on the arrow beside the title of the file
• Click on the “show events” button

The result will display all events that occurred on the file like:

• Shared drive membership change
• Document access scope change
• ACL Change
• Contributors can’t share
• Download
• Edit
• Print
• View
• Create
• Move
• Delete
• Rename
• Preview
• Add to Folder
• Remove from Folder
• Trash
• Untrash
• Unknown

Set up as a Scheduled report  #

Apply filter and search for specific events (for example).

Set up as a Scheduled report.

• Scheduled – set up a Scheduled report 
• Occurrence – select the time when the report is to be triggered