What the Audit Trail shows
The Audit Trail in Drive is a record of who did what to your company's documents, access and imports. Every upload, download, share, move and delete is listed with the date, the person and a short summary. Entries cannot be edited or removed, so you can rely on it when you need to answer “who changed this?”.
Before you start
- Open Drive in the company whose trail you want to see.
- Only the company owner, or a member the owner allowed, can see the Audit Trail. If you do not have permission, the page says so and explains who to ask.
Open the Audit Trail
- Select Audit Trail in the left menu.
- Wait for the list to load. Each row shows When, Action, Record, Summary, By and Severity.
The newest entries come first, 50 at a time. Use Next and Previous under the list to move between pages. Select Refresh to load the latest entries.
Narrow the list with filters
Use the filters above the list, then select Apply:
- From date and To date limit the period.
- Action picks a kind of event, such as Uploaded, Downloaded, Viewed, Shared, Moved to trash, Permanently deleted or Access changes.
- Severity shows Info, Material or Security entries only.
- Person shows what one member did. Choose Anyone for everyone.
- Search looks through document names and summaries.
Select Clear to remove all filters. If nothing fits, the page says No audit entries match.
See the details of an entry
Select any row to open the Audit entry details panel. It shows the action, the record, who did it, the IP address and the device used. The Changes table lists each field with its old and new value, so you can see exactly what was edited. Select Close to go back.
Export the trail
If the owner has allowed you to export, an Export CSV button appears at the top. It downloads the entries that match your filters. When there are very many rows, the export holds only the newest ones and tells you so. Narrow the dates or filters and export again to get the rest. Without permission, you can view the trail but there is no export button.