Monitor Google Workspace

Learning Objectives

After completing this unit, you’ll be able to:

Navigate Google Workspace reports.
Access Google Workspace audit logs.
Create email alerts for significant administrative changes to Google Workspace.

Monitor Usage

You can monitor Google Workspace usage via the admin console and Reports API. For the purpose of this exercise, let’s focus on the admin console.

As an administrator, you want to examine potential security risks, measure user collaboration, track who signs in and when, analyze administrator activity, and much more. The admin console provides tools that you can use to analyze usage data. Reports have interactive graphics and tables that show broad, domain-level data alongside granular, user-level details.

You can hover your cursor over graphics to see specific data, set filters to adjust the scope of the data each report covers, and click table cells to see accompanying graphical representations.

As you have only recently set up your domain, your reports will contain limited information or there may be no data available. Please also note that not all reports are available in every edition of Google Workspace.

However, it’s useful to understand the reports that are available to you as the administrator. In this exercise you examine your Google Workspace reports.

If you are not already signed in, sign in to your domain as the administrator at admin.google.com.
Click the Reports icon.
The default view is the highlights report. This provides key metrics and trends in your domain like app usage and user account status. Click any chart for more detailed information.
Click Reports in the left-hand menu, and take some time to review the different types of reports available to the Google Workspace administrator.

Note the options that are available for filtering, sorting and customizing your reports. You can also download report data.

View Audit Logs

As the admin, it’s best to be aware of changes being made to your organization.

The audit section allows you to quickly review the various events that are generated by administrators, users, and services. And it helps give you a deeper understanding of how your users are interacting with your services.

You should note, however, that because you have only recently set up your domain, there will be limited data or no data available to view in many reports.

From the Reports section of the admin console, click Audit | Admin and explore the Admin audit log. From here you can see a record of all actions that have been performed in the admin console. For example, you can see user creations, changes made to service settings, and so forth. You can constrain the report by OU and date criteria and filter by Event name, User name, and Admin name.
Use the Add a filter button to filter by the User Creation event.
Click Clear Filters to clear the search filter.
From the menu on the left, select Audit | Calendar. From here you can track changes to calendars, events, and subscriptions in the Google Calendar audit log. Notice how the filter choices have changed from the previous report.
Explore some other audit reports and you will see how the filters provided are relevant to the type of data displayed in the current report.

Create Email Alerts

While it's useful to view events in the admin console audit log, it's probably more helpful to be alerted immediately of significant changes, such as when a user is deleted or suspended, or if settings are changed.

You can receive email alerts when something important happens in your organization, such as a suspicious sign-in attempt, a compromised mobile device, or when another administrator changes settings. When you turn on an alert for an activity, you’ll receive an email each time that activity happens, up to 25 emails in 2 hours.

Examine Google Workspace’s predefined alerts, and see how to create custom email alerts for when something important happens in your organization.

If you are not already signed in, sign in to your domain as the administrator at admin.google.com.
Click the Rules icon. From here you can see the predefined rules and the status and action to take for each rule.
For system defined rules, scroll through the predefined rules to see the different types of alerts you can receive.
Click any alert to see more details. Hover over the Rule details and scope, Conditions, and Actions cards.

Notice how you can only change the 'Actions' to take for a System defined rule. You can enable and disable the rule, set the severity, and manage the users that will receive the notification when the rule is triggered.

Create a Custom Rule

In addition to the predefined alerts, you can create your own custom rules. The types of rule that you can create depend upon your Google Workspace edition.

Activity rules: With these rules, you can automate actions that happen in response to activity within your domain. Activity rules are not available in the trial version of Google Workspace.

Data protection rules: You can use these rules to be notified of specific activity related to the use of Drive files within your domain. Data protection rules are not available in the trial version of Google Workspace.

Reporting rules: Previously called Custom reporting alerts, you can use these rules to create and manage custom alerts based on your organization’s audit logs.

Let's create a rule to monitor user suspensions.

Return to the Rules page, and click Create rule | Reporting. You will be redirected to the Admin Audit Log page.
Click Add a filter, and select Event name.
Select User Suspension.
Click Create a reporting rule (the bell icon in the top right corner of the page).
Enter a name for the rule User suspension event.
Enable the Send to super administrators option, then click Create.
Return to the Rules page. Can you see your new rule listed?
Suspend a user and then check your inbox. Did you receive a User suspension event alert?
Reactivate the user that you suspended in the previous step.

Explore the other audit logs and create one or two more custom reporting rules.

Email Log Search

Google Workspace enables you to sort through the last month of email delivery activity and evaluate message transit.

This is useful for tracking a sender or recipient’s missing messages, such as those that have been quarantined as spam or otherwise routed incorrectly. Use the Email Log Search feature to troubleshoot how Gmail policies affect mail flow.

You start by performing a search of the log, then you examine the results—analyze route and delivery states. You can also see post delivery status such as message labels.

In this exercise you explore the Gmail Log Search options available in the admin console. Ensure you read the Help Center resources.

If you are not already signed in, sign in to your domain as the administrator at admin.google.com.
Click the Reports icon.
Select Email Log Search from the menu on the left.
Explore the search options:
1. Date (Note that detailed delivery information is only available for messages received in the last 30 days)
2. Search by sender or recipient or their IP addresses
3. Search by subject or message ID
Perform a search for messages received by yourself in the past 7 days. Note: It can take an hour for messages to be logged.
Click any valid message. From here you can view message and recipient details. You can also view the post delivery message details such as read status, labels, and so on. Note: You cannot see the actual message.

You can search for messages older than 30 days but you must know the message ID and detailed delivery logs are not available for these messages.

도움말 검색