Reports, security investigation tool, & audit and investigation page
Because of lag time, some reports and search results in the security investigation tool and audit and investigation page might not show the latest data. Additionally, log event data is retained for specific time periods before it's no longer available. Administrators cannot delete log event data or change the length of time that the data is available for.
Thefollowing sectionsshow how long it can take before data is available for various reports and log eventsand how long data is retained.
Important: There's a small chance that reports and log event data for some events will be delayed beyond the following specified times. In rare cases, events might not be reported.
Lag times
Lag times indicate the delay between when a log event occurs and when the data for that event is available in Admin console reports and log events.
The following lag times apply to log events data from the audit and investigation page, security investigation tool, alert center, and the Admin SDK Reports API.
Users can view security events in the alert center, and they can also use the Reports API to obtain activity and usage reports.
| Log events name | Lag time |
|---|---|
| Access Transparency log events | Near real time (couple of minutes) |
| Admin log events | Near real time (couple of minutes) |
| Admin Data Action log events | Near real time (couple of minutes) |
| Assignments log events | Near real time (couple of minutes) |
| Calendar log events | Tens of minutes (can also go up to a couple of hours) |
| Chat log events | Near real time (couple of minutes) |
| Chrome log events | Near real time (couple of minutes) |
| Classroom log events | Near real time (couple of minutes) |
| Cloud Search log events | Up to a few hours |
| Context Aware Access log events | Near real time (couple of minutes) |
| Devices log events | Near real time (couple of minutes) |
| Directory Sync log events | Near real time (couple of minutes) |
| Drive log events | Near real time (couple of minutes) |
| Gmail log events | Near real time (couple of minutes) |
| Groups log events | Tens of minutes (can also go up to a couple of hours) |
| Jamboard log events | Near real time (couple of minutes) |
| Keep | Near real time (couple of minutes) |
| LDAP log events | Near real time (couple of minutes) |
| Looker Studio log events | Near real time (couple of minutes) |
| Meet hardware log events | Near real time (couple of minutes) |
| Meet log events | Near real time (couple of minutes) |
| Meet quality | Near real time (couple of minutes) |
| OAuth | Up to a few hours |
| Rules log events | Near real time |
| SAML log events | Near real time (couple of minutes) |
| Takeoutlog events | Event when Takeoutprocess starts: Near real time Event when the Takeout process finishes: Depends on the size of the data, up to many days |
| Tasks log events | Near real time (couple of minutes) |
| Token log events | A couple of hours |
| User log events | Login events: Up to a few hours User account events: Tens of minutes |
| Vault log events | Near real time (couple of minutes) |
| Voice log events | Near real time |
Retrieving report or log events data for older dates or a wide time range might take so long that by the time results are available, the most recent log data might no longer be fresh. For tools that require real-time monitoring, use a short-time range.
Many products previously listed above (such as Gmail and Google Drive) are relevant for Google Workspace only, and not for other Google services, such as Cloud Identity.
Highlight reports
| Report name | Lag time |
|---|---|
| Calendar report | 1–3 days |
| Classroom report | 1–3 days |
| Drive report (related to Document link shared status) | 1–3 days |
| Drive report | 1–3 days |
| Gmail report | 1–3 days |
| Hangouts report | 1–3 days |
Security reports
| Report name | Lag time |
|---|---|
| 2-Step Verification Enrollment report | 1–3 days |
| External apps report | 1–3 days |
| External shares report | 1–3 days |
| Internal shares report | 1–3 days |
Aggregate reports
| Report name | Lag time |
|---|---|
| Accounts report | 1–3 days |
| Apps Script report | 1–3 days |
| Apps and extension usage report (related to Chrome) | 1–3 days |
| Version report (related to Chrome) | 1–3 days |
| Drive report | 1–3 days |
| Gmail report | 1–3 days |
| Google Chat report | 1–3 days |
| Mobile report | 1–3 days |
Apps usage activity
| Report name | Lag time |
|---|---|
| Drive storage used report | 1–3 days |
| Files added report | 1–3 days |
| Files edit report | 1–3 days |
| Files viewed report | 1–3 days |
| Gmail storage used report | 1–3 days |
| Google Sheets added report | 1–3 days |
| Photo storage used report | 1–3 days |
| Total storage used report | 1–3 days |
Data retention
Note: For reports andlog events data not mentioned here, the retention time is generally 6 months.
You can accesslog events dataand reports data this far back:
| Log events data or report name | Data retention time |
|---|---|
| Access Transparencylog events data | 6 months |
| Account activity reports | 6 months |
| Admin log events data | 6 months |
| Admin Data Action log events data | 6 months |
| Assignments log events data | 6 months |
| Audit data retrieved using the API | 6 months |
| Calendar log events data | 6 months |
| Chat log events data | 6 months |
| Chrome apps and extension usage report | 12 months |
| Chrome log events data | 6 months |
| Chrome version report | 12 months |
| Classroom log events data | 6 months |
| Cloud Search log events data | 6 months |
| Context-aware access log events data | 6 months |
| Customer/User usage data retrieved using the API | 15 months |
| Devices log events data (availability of these logs depends on your subscription) | 6 months |
| Drive log events data | 6 months |
| Email log search | 30 days |
| Entities usage data retrieved using the API | 30 days |
| Gmail log events | 6 months |
| Groups log events data | 6 months |
| Keep log events data | 6 months |
| Jamboard log events data | 6 months |
| Looker Studio log events data | 6 months |
| Meet hardware log events data | 6 months |
| Meet log events data | 6 months |
| Meet quality tool | 30 days (Meetings older than 28 days are not displayed in the Admin Console) |
| OAuth Token log events data | 6 months |
| Rules log events data | 6 months |
| SAML log events data | 6 months |
| Security reports | 6 months |
| Tasks log events data | 6 months |
| Users | 6 months |
| User log events data (previously named Login audit log) | 6 months |
| Vault log events | Indefinite |
| Voice log events data | 6 months |
Was this helpful?
How can we improve it?
Need more help?
Try these next steps:
Start your free 14-day trial today
Professional email, online storage, shared calendars, video meetings and more. Start your free Google Workspace trial today.
