Classroom log events

Track user activity in Classroom

Supported editions for this feature: Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; additionally, Google Workspace for Nonprofits. Compare your edition

As your organization's administrator, you can run searches and take action on security issues related to Classroom log events. There you can view a record of actions to analyze user activity in Classroom, such as:

Review common activities, such as who removed a student from a class or archived a class
Troubleshoot common user scenarios

Run a search for Admin log events

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

Audit and investigation tool

Security investigation tool

Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

To run a search in the security investigation tool, first choose a data source. Then, choose one or more conditions for your search. For each condition, choose an attribute, an operator, and a value.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Security center > Investigation tool.
Requires having the Security center administrator privilege.
Click Data source and select Classroom log events.
Click Add Condition.
Tip: You can include one or more conditions in your search or customize your search with nested queries. For details, go to Customize your search with nested queries.
Click Attributeselect an option.
For a complete list of attributes, go to the Attribute descriptions section.
Select an operator.
Enter a value or select a value from the list.
(Optional) To add more search conditions, repeat steps 4–7.
Click Search.
You can review the search results from the investigation tool in a table at the bottom of the page.
(Optional) To save your investigation, click Save enter a title and descriptionclick Save.

Notes

In the Condition builder tab, filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
If you give a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.

Attribute descriptions

For this data source, you can use the following attributes when searching log event data:

Attribute	Description
Actor	Email address of the user who performed the action—for example, the user who created the class, or the user who published an announcement
Actor group name	The group name of the actor. For more information, go to Filtering results by Google Group. To add a group to your filtering groups allowlist: Select Actor group name. Click Filtering groups. The Filtering groups page appears. Click Add Groups. Search for a group by entering the first few characters of its name or email address. When you see the group you want, select it. (Optional) To add another group, search for and select the group. When you finish selecting groups, click Add. (Optional) To remove a group, click Remove group . Click Save.
Actor organizational unit	Organizational unit of the actor
Add-on ID	Unique identifier for an add-on
Add-on title	Title of the add-on
Add-on attachment ID	Unique identifier for an add-on attachment
Add-on attachment title	Title of the add-on attachment
Course ID	Unique identifier for a class
Course name	Name of the class
Course role	Whether a user is a student or teacher in a class
Course work title	Title of the class work
Course work type	Type of class work, such as Assignment or Question
Date	Date and time of the event (displayed in your browser's default time zone)
Document ID	Unique identifier for a submission
Due date	Date a student's work is due
Event	The logged event action, such as class created or User joined class
Event source	Whether or not the source of the event is from an API
Guardians*	Email addresses of the student's guardians
Has grade	Whether or not a submission has a grade
Impacted users*	List of impacted email addresses
IP address	The IP address used to sign in. Usually the address is the user's physical location. It can also be a proxy server or a Virtual Private Network (VPN) address.
Is late	Whether or not a submission is late
Join method	The way a user joined the class—for example, From an invitation or From a class code
Post ID	Unique identifier for a piece of class work
Previous course owner	The previous class owner's email address
Submission state	Submission state of a class work—for example, Created, Turned in, Returned, Reclaimed by student, or Student edited after turn-in

* You cannot create reporting rules with these filters. Learn more about reporting rules versus activity rules.

Note: If you gave a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.

Filter data by class events

To see data related to class membership, class events, or class work, filter by event and then select an event value.

Open the log events as described earlier on this page in Run a search for Admin log events.
Click Add a filterEvent.
Select the operator.
From the drop down list, select a value.
Click Apply.

Export data to BigQuery

Important:

You must have an Education Standard or Education Plus account.
Your administrator must enable the option to export.

To export your data to BigQuery:

Sign in to your Google Admin console.
Sign in using your administrator account, not your personal Gmail account.
On the left, click ReportingBigQuery Export.