Class Tools log events

View Class Tools log events in the Admin console

This page is for administrators. If you are a teacher and want to learn how to use Class Tools, go to Use Class Tools.

As an administrator, you can run searches and take action on security issues related to Class Tools log events. You can view a record of actions taken by teachers and users—for example, if a teacher views a student’s screen or a student turns on live captions during a Class Tools session.

How you search for Class Tools log events depends on your organization's Google Workspace for Education subscription:

Education Fundamentals (with Teaching and Learning add-on)—Use the audit and investigation tool.
Education Plus—In addition to the audit and investigation tool, you also have access to the more advanced security investigation tool.

Run a search for Class Tools log events

For ChromeOS version 146 or later

Audit and investigation tool

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Do one of the following:
1. Go to Menu ReportingAudit and investigationChrome log events.
2. Go to MenuDevices Chrome ReportsChrome log events.
  Requires having the Audit & Investigation administrator privilege.
At the top, click Condition builder.
In the Condition builder tab, filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
To filter events that occurred before or after a specific date, for Date, select Before or After. By default, events from the last 7 days are shown. You can select a different date range or click to remove the date filter.
Click Add Condition.
Configure the condition:
1. For Attribute, select an option.
2. Select an operator.
3. Enter a value or select a value from the list.
  Example Class Tools condition: Event reasonContainschromeos_class_tools.
(Optional) To add more search conditions, repeat the steps.
Click Search.
You can review the search results from the investigation tool in a table at the bottom of the page.
(Optional) To save your investigation, click Saveenter a title and descriptionclick Save.

Security investigation tool

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Security center > Investigation tool.
Requires having the Security center administrator privilege.
Click Data source and select Chrome log events.
Make sure that Condition builder is selected.
In the Condition builder tab, filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
To filter events that occurred before or after a specific date, for Date, select Before or After. By default, events from the last 7 days are shown. You can select a different date range or click to remove the date filter.
Click Add Condition.
Configure the condition:
1. For Attribute, select an option.
2. Select an operator.
3. Enter a value or select a value from the list.
  Example Class Tools condition: Event reasonContainschromeos_class_tools.
(Optional) To add more search conditions, repeat the steps.
Click Search.
You can review the search results from the investigation tool in a table at the bottom of the page.
(Optional) To save your investigation, click Saveenter a title and descriptionclick Save.

For information about using the audit and investigation tool to review user and administrator activity in your organization, go to About the audit and investigation tool.