Groups log events

Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more

As your organization's administrator, you can run searches and take action on security issues related to Groups log events. For example, you can track changes to groups, group memberships, and group messages for users in your organization. You can also troubleshoot when users in your domain notice discrepancies and unexpected changes to their group activities. Entries usually appear within half an hour of the user action.

Note: To view actions performed within the Google Admin console, Google Cloud console, Admin SDK API, Cloud Identity API, and Google Groups user interface, go to Groups Enterprise log events.

For a full list of services and activities that you can investigate, such as Google Drive or user activity, see Run a search in the audit and investigation tool.

Types of changes you can track

• Group creation and deletion—You can verify that a group exists and was not recently deleted.
• Member addition, removal, and banning—If a user didn't receive a group message, you can check the log event data to see if the user is a group member. If the user was removed or banned, the data also shows who removed or banned them and when.
• User invitations and join request approvals—You can verify whether a user received an invitation to join a group and whether the invitation was accepted or denied. You can also track whether a user's request to join a group was approved or denied.
• Group posting permission changes—Users may unexpectedly receive a bounce message saying that they're not permitted to post. Log event data shows any changes to the posting permissions that would prevent the user from posting.
• Spam moderation settings—If messages are sent to the moderation queue instead of being posted, log event data will show if message moderation was a recent settings change.
• Other settings—When other settings are changed, log event data provides details about the changes.

Groups log events are only for the Google Groups interface. Event data tracks both user and administrator actions executed using the Google Groups interface. Google Groups actions performed by administrators using the Admin console or the Admin SDK directory API are logged in Admin log events and Groups Enterprise log events.

Run a search for log events

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.