Calendar audit log
This feature is not available in the legacy free edition of Google Apps. This feature is also not available in the government edition of Google Apps.
The Calendar audit log lets you track changes to calendars, events, and subscriptions for users in your domain, and troubleshoot when users in your domain notice discrepancies and unexpected changes to their calendars (or shared calendars) and to specific events on their calendars. Entries usually appear within half an hour of the user action.
To access the Calendar audit log, sign in to your Admin console, click Reports > Audit > Calendar. The page displays the following information:
Activity Name | The action that was logged, such as adding or deleting calendars, events, guests, or subscriptions to event reminders and notifications. |
|
A log entry for each time a calendar access level changes. |
|
A log entry for each time a calendar country changes. |
|
A log entry for each time a calendar is created. |
|
A log entry for each time a calendar is deleted. |
|
A log entry for each time a calendar description is changed. |
|
A log entry for each time a calendar location is changed. |
|
A log entry for each time a calendar timezone is changed. |
|
A log entry for each time a calendar title is changed. |
|
A log entry for each time an event is created. |
|
A log entry for each time an event is deleted. |
|
A log entry for each time a guest is added to an event. |
|
A log entry for each time a guest is removed from an event. |
|
A log entry for each time a guest response changes for an event. |
|
A log entry for each time an event is modified. This generic entry is only shown when no more specific action log entries are available. |
|
A log entry for each time an event is removed from calendar trash |
|
A log entry for each time an event is restored from calendar trash |
|
A log entry for each time an event title is modified. |
|
A log entry for each time a subscription is created. |
|
A log entry for each time a subscription is deleted. |
Activity description | The details of the event described in the Activity name field. |
User name | The email address of the user who triggered the event. |
Calendar id | The name of the calendar in which the event resides. |
Event title | The title of the calendar event. |
Event id | The id number of the calendar event. |
API Kind | The API through which the change was made. Choose between Unknown, API V3 (usually Android), Web, GData (usually older Android devices), iCal (event invitations from other calendaring systems), or CalDAV (usually Apple devices). |
IP Address | The internet protocol (IP) address used by the administrator to sign in to the Admin console. This might reflect the administrator's physical location, but not necessarily. For example, it could instead be a proxy server or a virtual private network (VPN) address. |
Date and time range | The date and time the event occurred (displayed in your browser's default timezone). |
Use the Filters section at the side to configure the page to only display data that meets certain criteria. For example, the page can show events of a particular type, or events that occurred during a specific date range. Once you've entered your criteria, click Search to filter. To clear your filters, click Reset.
You can also use the Filters section to create and configure a custom alert. Custom alerts do not use the Date Range. Choose an event name from the drop-down list and your other filters, then click the SET ALERT button. In the Set alert: window you can add a custom alert name, check the Super Administrator(s) box, or add additional recipient user emails. After you configure your custom alert click the SAVE button. To edit your custom alerts, refer to Account activity alerts.
- If you don't see the Filters section, click .
- To change the columns the log displays, click . The page remembers the columns you choose and shows the same ones the next time you sign in. The columns are:
- User
- Calendar ID
- Event Title
- Event ID
- API Kind
- Date
- IP Address
- The log shows near real-time data (as recent as the last few minutes) and keeps data from up to six months ago.
The Admin console reports show historical data generated for the last seven days, the last month, the last three months, or the last six months. The date in the upper right indicates the most recent day for which report data is available. The pulldown arrow next to the date opens a calendar page you can use to select another day to use. The latest date for which all data points are present has a green background. You can select another date beyond the full data date but any later date you choose may have partial data and may only show a subset of the expected reports.
Data retention times
You're able to access saved Admin console audit logs and reports data this far back:
Name of Log or Report |
Retention Time |
---|---|
Admin audit log | 6 months |
Calendar audit log | 6 months |
OAuth Token audit log | 6 months |
Mobile audit log (Google Apps Unlimited) | 6 months |
Drive audit log (Google Apps Unlimited) | 6 months |
Email log search | 30 days |
Account activity reports | 6 months |
Security reports | 6 months |
Groups audit log | 6 months |
Audit data retrieved using the API | 6 months |
Reporting data retrieved using the API | 15 months |
For other audit logs and reports not mentioned above the retention time should be 6 months.
Lag times
The lag times in this table reflect how long it takes before collected data tied to specific Admin console reports and audit logs is available to view.
Item Name | Report Name | Lag Time |
---|---|---|
Highlights | ||
Gmail | Gmail report | 1 day to 3 days |
Drive | Drive report | 2 days to 6 days |
Hangouts | Hangouts report | 1 day to 3 days |
G+ | G+ report | 1 day to 3 days |
Calendar | Calendar report | 1 day to 3 days |
Document Link Shared Status | Drive report | 2 days to 6 days |
Security | ||
External Link Shared Files | Drive report | 2 days to 6 days |
External Link Shared Files | Security report | 1 day to 3 days |
2-step verification enrollment | 2SV report | 1 day to 3 days |
Aggregate Reports | ||
Accounts | Accounts report | 1 day to 3 days |
Gmail | Gmail report | 1 day to 3 days |
Drive | Drive report | 2 days to 6 days |
G+ | G+ report | 1 day to 3 days |
Mobile | Mobile report | 1 day to 3 days |
Apps Usage Activity | ||
Files Owned | Drive report | 2 days to 6 days |
Total Emails | Gmail report | 1 day to 3 days |
Total Storage Used | Quota report | 1 day to 3 days |
Audit | ||
Admin | Admin audit | near real time (couple of minutes) |
Login | Login audit | tens of minutes (can also go up to a couple of hours) |
Drive | Drive audit | near real time (couple of minutes) |
Calendar | Calendar audit | tens of minutes (can also go up to a couple of hours) |
Mobile devices | Mobile audit | near real time (couple of minutes), up to 4 hours, if updated at next sync. |
Token | Token audit | tens of minutes (can also go up to a couple of hours) |
Groups | Groups audit | tens of minutes (can also go up to a couple of hours) |
Email log search | Email audit | near real time (couple of minutes) |
Retrieving report or audit log data for very old dates or large time ranges may take so much time that once results are available the most recent log entry may no longer be fresh. For applications that require real-time log monitoring use a small time range.