Google Drive File Activity Audit and results helps

[Denis H]

Hello All,

I am wondering if it is possible, leveraging GAM, to be able to audit our whole Google Workspace for all drive files that have been accessed (viewed, editted etc.) in the last 90 days and return a list containing:

Name of File

Location of File (Team Drive name or users my drive name)

User that accessed file (whether internal or external) 

Date the file was accessed

File URL (may not be necessary)

I have used GAM in the past and it was immensely helpful but have not set it up in this environment yet, so I was wondering if the above is possible? 

Thank y

[Maj. Marshall Giguere]

Dennis;

Sadly, unlike *NIX systems, Google only tracks the create and last modified times.

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/91a5511d-1f79-412a-8e55-d1b79c853dafn%40googlegroups.com.

[Denis H]

Hello,

Thank you for helping out. I am able to see the timestamps on events of files (view, download, comment reassigned etc.) by using the native audit and investigation on drive log events from google admin but am not seeing the user who's drive the file is in and also the shared drive name (it does show shared drive ID for the action).

[Maj. Marshall Giguere]

If you want the "user" look for the "actor" in the report.

Ross says please respond to his message.

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/b2f26079-8fef-49a9-bb96-d392a48eb262n%40googlegroups.com.

[Denis H]

Hello,

I do not see any message from Ross. How did he reach out to me? 

Thank you

[Maj. Marshall Giguere]

Ross didn't say.  Possibly the chat, or the first message in the group, there were two.

The reports api tracks a ton of drive events. Here's a basic get all drive events starting 90 days ago

> gam redirect csv ./driveEvents.csv report drive range "2025-10-13" " 2026-01-12" events "create,delete,move,download,view"

This will result in thousands or api calls and  events.  Each requires, I believe, a separate api call.  Suffice it to say it's a lot of calls and if you have lots of users it can take a while and result in lot of data.

Maj. Marshall E. Giguere
New Hampshire Wing, Directory of IT
Civil Air Patrol, U.S. Air Force Auxiliary
GoCivilAirPatrol.com
nhwg.cap.gov
Volunteers serving America's communities, saving lives, and shaping futures.

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/835c1599-36a4-4670-819a-9552c31eed96n%40googlegroups.com.

[Maj. Marshall Giguere]

 

Should have included "edit" in the events list

> gam redirect csv ./driveEvents.csv report drive range -90d today events "copy,create,delete,download,edit,move,view"

[Temsnr]

I've mentioned this before - you can set up a project to export reporting logs to BigQuery: https://support.google.com/a/answer/9082756?hl=en&ref_topic=9079469&sjid=10512996779390788484-EU. Once the logs are being collected, there are some example queries here: https://support.google.com/a/answer/9079965?hl=en&ref_topic=9079469&sjid=10512996779390788484-EU#zippy=

depending on the size of your Google Workspace, this will gather a huge amount of data very quickly. You can keep years worth of logs this way. It's excellent for forensic investigation.

I split each year's (or whatever period suits, depending on the size of your user base) set of logs into a separate database to keep query costs lower. You could also split the logs into databases by log type ... I noticed that they've finally included logs for data migration!

This isn't GAM, of course, but it can be very useful at times.

Temple