Available in the following versions: Frontline; Business Standard and Business Plus; one or more Enterprise editions; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; G Suite Business; Essentials



As an administrator, use the audit and investigation page to run searches related to Drive log events. You can view a record of actions to see your organization's user activity in Drive. Drive log events include content your users create in Google Docs, Sheets, Slides, and other Google Workspace apps, and content that your users upload to Drive, such as PDFs and Microsoft Word files.


Important:

- To find out the data retention and lag times, plea visit https://support.google.com/a/answer/7061566

- Drive audit events are logged only for files owned by users with supported editions.



Access Drive log event data


- Go to admin.google.com

- On the left, click Reporting / Audit and investigation/ Drive log events.

Filter the data

- Open the log events as described above in Access Drive log event data.

- Click Add a filter, and then select an attribute.

- in the pop-up window, select an operator / select a value / click Apply.

- (Optional) To create multiple filters for your search:

    Click Add a filter and repeat step 3.

    (Optional) To add a search operator, above Add a filter, select AND or OR.

- Click Search.


Further information to be found here: https://support.google.com/a/answer/4579696?hl=en