Automating a GAM command to pull admin reports based on start time

[Nicholas Mavrenovic]

Hello,

We have a GAM command that looks at groups created starting from 8/8/18 then modifies the view membership setting to all in domain.

However, my question is if there's a way to automate the first GAM command below so that the start time of the admin report log it's gathering changes based on system time, or something similiar, so that it looks back at the last 30 days at the time the GAM command is ran?

gam report admin start 2018-08-08T00:00:00.000Z event CREATE_GROUP > groups.csv

gam csv groups.csv gam update group ~parameters.0.value who_can_view_membership all_in_domain_can_view > DLViewingresults.csv

I couldn't find any conditions that are configurable in the API documentation, but basically I would like this command to pull reports of groups created in the past 30 days at the time the script is ran. I'm not sure if there's a way you can do this with the API itself, or if this would require a python/PS script in order to run. In essence, I want this command to be fully automated so that it doesn't require anyone to modify the script later on.

I do know there's this command:

gam report groups start -30d event create_group parameters group_email > groups.csv

But the problem with this command is the Groups reports API doesn't log groups created via Google Cloud Directory Sync (which is what we're trying to pull logs of). However, the parameter "-30d" would be exactly what I want for the script above, I just couldn't find this in the documentation for Admin Reports API.

Thanks,

Nick

[Ross Scroggs]

Nicholas,

I'm not sure that I'm following, these two commands are equivalent:

gam report admin start 2018-08-21T00:00:00.000Z event CREATE_GROUP > groups.csv

gam report admin start -30d event CREATE_GROUP > groups.csv

The -30d is converted to 2018-08-21T00:00:00Z by Gam, the API sees exactly the same data from Gam.

I do know there's this command:

gam report groups start -30d event create_group parameters group_email > groups.csv

But the problem with this command is the Groups reports API doesn't log groups created via Google Cloud Directory Sync (which is what we're trying to pull logs of).

This is not a Gam issue, it's a Google issue, call them.

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/2e5c4733-b637-4f64-b55a-dc65d2352a75%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Ross Scroggs

ross.s...@gmail.com

[Nicholas Mavrenovic]

Thanks Ross, I tried adding the "-30d" before and it didn't work, but that was probably cause I had something else wrong with the command. Anyways, thanks for the insight!

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/2e5c4733-b637-4f64-b55a-dc65d2352a75%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Ross Scroggs

ross.s...@gmail.com

[+KimNilsson]

Yes, but Create Group is available in the admin report, isn't it?

What annoys me is that the Group report in admin console is so bad compared to the Admin Report.

If you base your action on where the CreateGroup event is, it shouldn't really matter which report it comes from, no?

[Nicholas Mavrenovic]

That's right, but it depends on how you do it. For example, if you create a group via the Groups interface then a create group event is logged by the Groups report, instead of the Admin Report. If you create a group in the admin console or if you access the Admin Directory API SDK then the create group event is logged in the Admin Report. They document it here: https://support.google.com/a/answer/6270454?hl=en

The Groups audit log is only for the Google Groups interface. It logs both user and admin actions executed using the Google Groups interface. Google Groups actions performed by administrators using the Admin console or the Admin SDK directory API are only logged in the Admin audit logs.

[Kim Nilsson]

Ok, then, sadly, your only option is to request Google put the admin/API actions in both logs.

GAM can't do what you ask until the data is available through the API.

Else you set up two scheduled GAMs. One for the Groups Report log and one for the Admin log.

/Kim

--

There is No Substitute!

google.com/+KimNilsson