How does google arrive at 30-day unique users, also head's up on Gmail timestamp changes

[Justin H]

Does anyone know exactly how Google determines the monthly active users metric, specifically the 30-day unique logins? I've compared all our log data and it is not just the unique logins per the user logs-- I looked at 6 months of this data and included logouts, and am a bit over 10% under the number that Google reports for our domain's 30-day unique logins.

Google says this, which sounds simple enough until you look at the actual data and it doesn't match up:
"Active users are defined as the peak number of 30 day unique logins over the past 180 days. The report in the Admin Console titled What’s the 30-day unique login count, reflects 30 day unique logins over the course of the past 6 months. This count will update twice per year and adjust the total storage amount in the domain accordingly."

If we look at just the Drive and Gmail activity logs (timestamps of last activity), I only get about half the number of users actively doing something in those apps. 

I suspect it is the user logins/logouts + all oAuth activity, maybe? Our domain and activity for those logs are too large to feasibly pull. 
Anybody figure out the exact recipe for this secret sauce recipe?

ALSO, just a head's up that as of last month, the Gmail API has changed how the Gmail timestamps are reported. They are now showing only "within last 30 days" for all Gmail timestamps. The API documentation was updated to show this, but it's still somewhat nonsense... We were trying to base some historical activity stats around these stats, but lastGmailAccess timestamp has always been useless (shows recent dates even for accounts that have never been logged into, and its not delegate activity either). Now with the changes, lastGmailInteraction seems to be doing similar odd stuff.. 

Thanks!

--Justin

[Justin H]

A little further clarification: If you pull an Users Report for all users (User reports > Accounts) you will find the 30-day metric in question, as there is a "Last login" timestamp for each users, that matches the 30-day unique user metric. HOWEVER, it is this "Last login" timestamp that is not obvious in how it is being obtained, as it is not simply the user logins. I've pulled those from the Users report and deduped the data, the math doesn't quite add up to all the Last logins. So something else is being included, just not sure what.

--Justin