Troubleshoot Google Workspace audit logs

If you encounter issues with your audit logs for Google Workspace, see the following information.

If these steps don't resolve the problem, open a support request.

I don't see audit logs for Google Workspace in Cloud Logging

When I go to the Logs Explorer, I don't see any audit logs.

Try the following steps:

I've verified sharing and permissions are correct, but I still can't see any audit logs for Google Workspace in the Logs Explorer.

Try the following steps:

  • Confirm that these log entries exist in the Google Admin console.

  • Verify that you're using the Logs Explorer instead of the Legacy Logs Viewer.

  • Search for logs at the organization level, not at the project level.

  • Use the Resource drop-down menu in the Logs Explorer to select Audited Resource. The Google Workspace audit logs field resource.type is equal to audited_resource.

    Audited resource is selected

  • Expand the time range of the query.

I can see audit logs for Google Workspace in the Logs Explorer, but the gcloud CLI commands aren't returning them.

Try the following steps:

  • Verify that the correct logName is used. Supply a valid ORGANIZATION_ID in each of the log names. Here are the audit log names for Google Workspace:
    organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity
    organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access
  • Verify there are no errors in your ORGANIZATION_ID or logName.

I can see audit logs for Google Workspace, but logs are delayed

Your log data might be delayed or missing due to latency. For more information about latency, see Data retention and lag times.

I can see log entries, but a field is missing or incorrect

For issues of missing or incorrect fields, open a support request with Google Workspace Support.

The following are examples of missing fields:

  • The same log record exists in both the Google Admin console and Logs Explorer, but a field is missing from both. For example, the IP address is missing in both.

  • The same log record exists in both the Google Admin console and the Logs Explorer. However, a field exists in the Google Admin console and is either missing or incorrect in the Logs Explorer.

I can't create log-based metrics for Google Workspace logs

Log-based metrics apply only at the Google Cloud project level. Google Workspace logs are organization-level logs.

Contact Support

You can contact the proper support team if the troubleshooting steps do not resolve your issue.

Contact Google Workspace support

For questions about logs in the Google Admin console, contact Google Workspace support.

Contact Google Cloud Support

For questions about Logging, such as viewing, exporting, or creating sinks and metrics, please contact Google Cloud support: