What's There in Admin Console Reports, Logs and Alerts
Admin reports help us to check advanced reports and security audits based on the topics described in this article.
Security reports
Security reports use to get exposure of G Suite data outside of the domain for each of the users, such as the number of externally visible files, apps installed externally, security key enrollment status, less secure app accessibility, and users who have 2SV enabled. Google recommends to run security reports before you enforce 2SV for your end users.
Apps usage activity reports
Apps usage activity reports help in details how users use Gmail and Drive. You can check and filter the following usage for each user in your domain:
Total megabytes (MB) of storage consumed in Gmail, Drive, and Google Photos.
Total number of emails sent and received.
Total number of Drive files owned, categorized by type of document and grouped together by total edits, shared files, and total views.
Account activity reports
Account activity reports provide us the status of a user account. You can check an aggregate report of all our activities, suspended, or blocked accounts. You can also get a report of the super administrators or administrator users in your domain to audit who has admin rights in a domain. Other features include you can check a report of all users who don’t have 2SV enabled if it’s a requirement for a domain.
Login audit log
The Login audit log gives a report of all web-based sign-ins for your domain and notes if they’re successful, unsuccessful, or suspicious. The report includes the username, sign-in type (password or SAML), date or time, and IP address. You can create filters in the report to quickly identify, for example, user accounts that could be compromised based on a known malicious IP address.
Calendar audit log
The Calendar audit log gives a list of all Calendar event actions in the domain, including the activity name and description, the user who created the event and in which calendar, the date, and IP address. Admin can use this audit log to review actions performed by a user over a specific period of time.
Email log search
Email Log search helps us to get delivery logs for your domains and evaluate message delivery using Email Log Search in the Google Admin console. These reports help us to track down messages, such as those quarantined as spam or otherwise routed incorrectly. Admin can also use the tool to determine message IP addresses and troubleshoot how policies affect mail flow.
For getting delivery of a message, you can use Email Log Search to investigate the status of a message after it has been delivered to a user's Gmail mailbox.
Manage alerts
Admin can receive notifications for suspicious sign-in notifications, Admin console changes, and user password changes. Admin can create custom alerts for OAuth tokens, Drive, Groups, or Calendar. We recommend sending these alerts to a mailing list that your support team monitors. Learn more about administrator alerts.
User setting alerts
Receive alerts for changes to user settings, such as suspension status, account creation or deletion, or administrator privilege permissions. For example, via the Admin console, you can receive notifications for newly created users who were granted administrator rights.
