I've verified sharing and permissions are correct, but I still can't see
any audit logs for Google Workspace in the Logs Explorer.
Try the following steps:
Confirm that these log entries exist in the Google Admin console.
Search for logs at the organization level, not at the project level.
Use the Resource drop-down menu in the Logs Explorer to select
Audited Resource. The Google Workspace audit logs field resource.type
is equal to audited_resource.
Expand the time range of the query.
I can see audit logs for Google Workspace in the Logs Explorer, but the gcloud CLI commands aren't returning them.
Try the following steps:
Verify that the correct logName is used. Supply a valid
ORGANIZATION_ID in each of the log names. Here are the audit
log names for Google Workspace:
The same log record exists in both the Google Admin console and
Logs Explorer, but a field is missing from both. For example,
the IP address is missing in both.
The same log record exists in both the Google Admin console and
the Logs Explorer. However, a field exists in the Google Admin console
and is either missing or incorrect in the Logs Explorer.
I can't create log-based metrics for Google Workspace logs
Log-based metrics apply only at the
Google Cloud project level. Google Workspace logs are organization-level logs.
Contact Support
You can contact the proper support team if the troubleshooting steps don't
resolve your issue.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Troubleshoot Google Workspace audit logs\n\nIf you encounter issues with your audit logs for Google Workspace, see the\nfollowing information.\n\nIf these steps don't resolve the problem, [open a support request](#support).\n\n### I don't see audit logs for Google Workspace in Cloud Logging\n\n*When I go to the Logs Explorer, I don't see any audit logs.*\n\nTry the following steps:\n\n- Confirm the sharing and permissions are configured correctly and you're using\n the Logs Explorer.\n\n- Verify that [Google Cloud sharing is enabled](https://support.google.com/a/answer/9320190).\n\n- Verify that the user has permission to view the logs in Google Cloud.\n Set the IAM role\n [Logging Private Logs Viewer](/logging/docs/access-control#permissions_and_roles) at the\n organization level.\n\n- Make sure you're searching for logs at the organization level, and not at\n the Google Cloud project level. For more information, see the\n [Google Workspace audit logging information page](/logging/docs/audit/configure-gsuite-audit-logs).\n\n*I've verified sharing and permissions are correct, but I still can't see\nany audit logs for Google Workspace in the Logs Explorer.*\n\nTry the following steps:\n\n- Confirm that these log entries exist in the Google Admin console.\n\n- Search for logs at the organization level, not at the project level.\n\n- Use the **Resource** drop-down menu in the Logs Explorer to select\n **Audited Resource** . The Google Workspace audit logs field `resource.type`\n is equal to `audited_resource`.\n\n- Expand the time range of the query.\n\n### I can see audit logs for Google Workspace in the Logs Explorer, but the gcloud CLI commands aren't returning them.\n\nTry the following steps:\n\n- Verify that the correct `logName` is used. Supply a valid \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e in each of the log names. Here are the audit log names for Google Workspace:\n\n```html\n organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity\n organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access\n```\n\n- Verify there are no errors in your \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e or `logName`.\n\n### I can see audit logs for Google Workspace, but logs are delayed\n\nYour log data might be delayed or missing due to latency. For more information about latency, see [Data retention and lag times](https://support.google.com/a/answer/7061566).\n\n### I can see log entries, but a field is missing or incorrect\n\nFor issues of missing or incorrect fields,\n[open a support request with Google Workspace Support](#gsuite_support).\n\nThe following are examples of missing fields:\n\n- The same log record exists in both the Google Admin console and\n Logs Explorer, but a field is missing from both. For example,\n the IP address is missing in both.\n\n- The same log record exists in both the Google Admin console and\n the Logs Explorer. However, a field exists in the Google Admin console\n and is either missing or incorrect in the Logs Explorer.\n\n### I can't create log-based metrics for Google Workspace logs\n\n[Log-based metrics](/logging/docs/logs-based-metrics) apply only at the\nGoogle Cloud project level. Google Workspace logs are organization-level logs.\n\nContact Support\n---------------\n\nYou can contact the proper support team if the troubleshooting steps don't\nresolve your issue.\n\n### Contact Google Workspace support\n\nFor questions about logs in the Google Admin console, contact\n[Google Workspace support](https://support.google.com/a/answer/1047213).\n\n### Contact Google Cloud Support\n\nFor questions about Logging, such as viewing, exporting, or\ncreating sinks and metrics, please contact Google Cloud support:\n\n- [Logging support page](/support/docs).\n\n- Premium, Role-Based, and Enterprise Support plans let you [manage support\n cases](/support/docs/manage-cases) in the Google Cloud console."]]
