Google Drive Audit Log: What to Monitor and How to Search It
Updated: 2 days ago
Most Google Workspace admins only open the Google Drive audit log after something has gone wrong: a file turned up outside the company, a folder vanished, or a reviewer asked who downloaded the client list. By then you are searching under pressure. A little familiarity beforehand turns the log from a forensic tool into a routine check.
What the Google Drive audit log records
The Google Drive audit log is the activity trail Workspace keeps for files in My Drive and Shared Drives. Each entry records who did what, to which file, from which account, and when. It covers viewing, editing, downloading, printing, sharing, moving and deleting. For sharing changes it also shows the old and new visibility, so you can see when a file went from restricted to link access.
Where to find the Google Drive audit log
In the Admin console, go to Reporting, then Audit and investigation, then Drive log events. Which log events you can see, and how far back, depends on your Workspace edition, and Google keeps this data for a limited window rather than indefinitely. Check your own retention period now, because it decides how far back any investigation can reach.
Once you are in, start with filters instead of scrolling. The most useful ones are:
Event name, such as download, change user access or change document visibility.
Actor, to follow a single account, for example a departing employee.
Document title or ID, to trace the history of one sensitive file.
Visibility, to isolate files shared externally or with anyone who has the link.
Five events worth watching
You do not need to read every row. These five patterns tell you the most, and each one is cheap to check:
Bulk downloads by one user in a short period, especially just before they leave.
Files shared outside your domain, particularly spreadsheets and anything with client or payroll data.
Visibility changes to anyone with the link on files that were previously restricted.
Ownership transfers and large deletions, which can be innocent cleanup or a cover-up.
Access by suspended or offboarded accounts that should no longer be active.
Turn the Google Drive audit log into alerts
A log you only read after an incident is a record, not a control. In the Admin console you can create activity rules that raise an alert when a matching event occurs, for example an external share of a file in a specific Shared Drive. Start with one or two narrow rules so the alerts stay meaningful. A rule that fires fifty times a day gets ignored by the second week.
Know the limits before you rely on it
The log tells you what happened to individual files. It does not give you a current picture of who has access to everything today, and it ages out. Pair it with a periodic permissions review so you cover both the history and the present state. Write down who owns the review and how often it runs, and put the date of the last one where your team can see it.
Want a current snapshot to pair with your logs? Run the free audit at app.neatdrive.net to see which files are shared externally, who still has access, and what to fix first.
Comments