Adding a Drive Label to a file(s)

[William Yox]

Hello colleagues,

In developing a strategy for quota management, Drive Labels seem a great way to notify users that specific files will go away when an account is de-provisioned. Today, I set out to test how to apply a particular drive label to a file via GAM.

The label to be applied is a Badged Label. Essentially, it's a hierarchical label with several "sub-labels."

I was able to get all of the information about the label via

gam show drivelabels full

I even got as far as adding the label to a single file using

gam user <User> process filedrivelabels <DriveFileID> addlabel <DriveLabelID>  addlabelfield <DriveLabelID> .......

Here is an image to illustrate this:

The Label Name "Warning" was added successfully; however, the Option "TO BE DELETED" was not applied.

Is this a syntax issue, or must you do a separate call to set the Options field?

Thanks!

[William Yox]

I figured it out....

I should have used addlabelfield by itself not along with addlabel. All is well thanks!

[Jesse Mulert]

I'm struggling with this to. I'm getting my drivelabels full output but having trouble identifying which ids are going where.

Here's my drivelabels basic output (because the full is too insane to post):
User: admin******@*****, Show 2 Drive Labels   Drive Label Name: labels/NRD7VkLrcWzdUDYnBa9WwIJHgWGCSpMaOMYRNNEFcb@20 (1/2)     id: NRD7VkLrcWzdUDYnBa9WwIJHgWGCSpMaOMYRNNEFcb     labelType: ADMIN     name: labels/NRD7VkLrcWzdUDYnBa9WwIJHgWGCSpMaOMYRNNEFcb@20     properties:       description: test description       title: Test badge     revisionId: 20   Drive Label Name: labels/4dTxjADBD9zCyF1MwIpQiqiI6ulqQhLl76IRNNEFcb@6 (2/2)     id: 4dTxjADBD9zCyF1MwIpQiqiI6ulqQhLl76IRNNEFcb     labelType: ADMIN     name: labels/4dTxjADBD9zCyF1MwIpQiqiI6ulqQhLl76IRNNEFcb@6     properties:       description: test description https://www.example.com       title: Test standard     revisionId: 6
I'm just seeing this single identifier repeated over and over "NRD7VkLrcWzdUDYnBa9WwIJHgWGCSpMaOMYRNNEFcb", with some suffix that must denote the iteration (@6, @20). 

So if the syntax is:  gam <UserTypeEntity> process filedrivelabels <DriveFileEntity> addlabelfield <DriveLabelID> <DriveLabelFieldID> 
I interpret that to mean that I'm looking for both a labelID and a labelFieldID

And I get an error like I'm missing a field when I pass a command like:   gam user som...@somewhere.com process filedrivelabels 1RvxEvl5a-H4IosbX6tXAUUt2uBPOjBOY addlabelfield 4dTxjADBD9zCyF1MwIpQiqiI6ulqQhLl76IRNNEbbFcb >>><<< ERROR: Missing argument: Expected <DriveLabelFieldID>

[Jesse Mulert]

K, got it sorted. Posting for posterity:

Like William said, when you're applying just the badge label (which you probably wouldn't ever want to do?), you can use just addlabel and then the label ID.
...but more likely, you're you're adding a specific option from that badge label (like the "to be deleted" option), so you need to use addlabelfield instead and then both the label ID and then the label field ID. Turns out you actually need a third ID for badge labels, which is the particular selection ID. So for badge labels, the syntax is actually:

gam <UserTypeEntity> process filedrivelabels <DriveFileEntity> addlabelfield <DriveLabelID> <DriveLabelFieldID> selection <DriveLabelSelectionIDList>

I was having trouble finding those last two field IDs within the messy output from show/print drivelabels full (btw, "show" is much more readable), so here's what it will look like (non essential stuff removed):

User: som...@somewhere.com, Show 1 Drive Labels
  Drive Label Name: labels/NRD7VkLrcWzdUDYnBa9WwIJHgWGCSpMaOMYRNNEbbFcb@20 (1/2)   <-- THE BOLD PART HERE IS THE DRIVELABELID
    ...
     (Misc attributes omitted here for brevity)
     ....
    fields:
      id: 6139D2C963   <-- THIS IS THE DRIVELABELFIELDID
       ....
        (more omitted stuff)
        .....
        properties:
          displayName: Warning   <-- PLAINTEXT NAME OF THE BADGE
          .....
          (more omitted stuff)
           .....
        selectionOptions:
          choices:
            id: E33C5047AC  <--- THIS IS THE SELECTION ID. IN OUR EXAMPLE, THIS CORRESPONDS TO "TO BE DELETED"
            ....
            ....
                description: This files will be deleted on xx/xx/xxxx
                displayName: To Be Deleted
              ....

[Grant D]

Thank you Jesse and others for posting this thread for posterity. 

I was also confused as to how these work. 

Hoping someone can clarify for me that there isn't a way to add drive labels for files the admini doesn't have edit access to. 

In my testing, i had to add my admin account to the file and then apply the label, if I didn't want to allow end users to change the status of the label. 

Thanks,

Grant

[Jesse Mulert]

If it’s Regular Joes files, perform as Joe. I.e. “gam user regul...@wherever.com process filedrivelabels…” not “gam user ad...@wherever.com….”  

If Joe should have rights to change the label, briefly grant them access and then loop through their stuff. It’s far less overhead than granting your admin user access to each file, labeling, and then stripping access. Over thousands of files it boils down to one command per file rather than three.

--
You received this message because you are subscribed to a topic in the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/qYj0PlCxpy4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/65980afb-df39-4f8b-9b31-653deefe037en%40googlegroups.com.

[Dierk Polzin]

Looking into this I find that Google File Labels have to be turned on in your domain in the Google Admin Center.

Google Workspace
         Drive and Docs
                   Labels

                          Allow users to apply labels and fields to files?

                               Turn Labels Off
                               Turn Labels On

[William Yox]

Hey Grant,

To mitigate this issue, I created a security group that can use labels. The file owner(s) are added to the groups, labels are applied to the file(s) as the owner, and then I remove the owner(s) from the group.

Add target users to Access Group

    gam csv <UserTargets>.csv gam update group access-drive...@yourorg.edu ~email

With Target Users, apply drive labels to Target Shared files

    gam csv <targetfiles.csv> gam user ~owner process filedrivelabels ~id addlabelfield  $DriveLabelID  selection  $DriveLabelSelectionID

Remove target users from Access Group

    gam csv <UserTargets>.csv gam update group access-drive...@yourorg.edu delete ~email

Best,

Bill

[William Yox]

That is true, but you can grant access to a few only using a security group. This way, members of your org can see the labels but cannot create, edit, or apply them. This is useful if you want your users to filter on files with labels, but nothing else. 

[Jesse Mulert]

We do the same thing but did learn that lags in those groups/permissions changes meant that we had problems when we were adding the user to the group, labeling, removing, and then iterating to the next user. Instead, we add all the users to the group, then do our user-by-user labeling, then pull everyone out of the group. Won't matter if you're taking about singleton users, but will matter if you're doing bunches of files/users.

I'll also just mention here that we discovered that the labeling user needs to have a proper license assigned to them, so that should be part of your process. In our instance, we have a certain number of education licenses and after that users just get a fundamentals license—even if those users are part of the group, they won't be able to label files properly until you assign them a proper license.

[William Yox]

Thats interesting, I have not had an issue with lagging permissions. I'll need to keep an eye out for it. 

I am working on cleanup of over 14,000 old accounts, and this was a very long process. Licesning groups of users, adding them to the group, labeling all of their files, removing them from the group, and removing their licenses. It must be a nightmare for larger orgs, It took me almost 2 weeks to label 2+ million files. 

[Grant D]

Hi Jesse and William,

Thanks for providing incite as to your experience with applying labels. 

I was hoping to get some guidance from Ross about how we can run this process more efficiently. 

We are trying to identify all Drive files older than 3 years, and apply a badge label to them, notifying users that we'd like to remove them. 

Here's the command i've been running: 

gam redirect stdout ./ApplyLog.csv multiprocess append redirect stderr ./ApplyError.txt multiprocess append csv gsheet <email-address.> <Sheet---ID> Sheet1 gam user "~Owner" process filedrivelabels "~id" addlabel <long label id>

We have something like 12 mil files that will need to be marked. 

Some testing that I've done over the past few days, seemed to go very slow. 

I have 3 instances of gam-adv, with 3 separate cloud console projects so we are not hitting api rate limits. 

Just using 14 google sheet reports that had the file ID and Owners to apply the label, i was averaging about 100k per hour. 

It seems like there are some batch settings that might make this run quicker, but again, wanted to check with Ross. 

Thanks,

Grant. 

[Ross Scroggs]

Grant,

Do: gam config verify

What is num_threads =

If it's 5, update it to 20 to bet more parallelism. gam config num_threads 20 save

Other than that, there's not much you can do.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/fd6df010-a79b-4663-9f46-b9fa782243f9n%40googlegroups.com.

[Grant D]

Thanks Ross! 

I will give that a try. 

[Grant D]

Hi Ross, 

So actually I had set num_threads between 50 and 60 at times. 

Right now its set to 50, and i'm not seeing many errors on the api page, or in my  logs. 

Was hopping there was some additional threading I wasn't utilizing: 

Defaut:

num_tbatch_threads = 2
num_threads = 20

Current: 

num_tbatch_threads = 2
num_threads = 50

Thanks,

Grant

On Monday, October 23, 2023 at 6:01:58 PM UTC-5 Ross Scroggs wrote:

[Grant D]

Hi Ross, 

Hoping that this thread hasn't gone silent. 

I forgot to ask if there is any advice you could give, if I needed to search if a label exists. 

The use case is: 

We are attempting to use Labels to notify file owners that a file is old, and should be deleted. 

(we know we should use vault, but we are taking baby steps to attempt to classify documents)

So there are situations where we need to see if files are older than x days and have not been labeled yet. 

There are also situations where if the file was labeled, the owner still uses it, and we need to remove the label. 

I really with the Drive API allowed for searching for Label. 

I also wanted to check back to see if num_threads = 40 or even 50 would cause problems.  

I've been monitoring the API requests page from the cloud console project, and haven't exceed the api limits. 

Thanks again for any advice you can provide here. 

Thanks,

Grant

 

On Monday, October 23, 2023 at 6:01:58 PM UTC-5 Ross Scroggs wrote:

[Ross Scroggs]

Grant,

Send me a Meet/Zoom invitation and we can discuss your situation.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/2896702e-4689-4f18-bf31-f29025b661d2n%40googlegroups.com.