📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Google Drive Monitor

See who viewed, changed, deleted or shared files in your Google Shared Drives and My Drive, and when and from where.

Where to find it
Google Workspace › Google Drive Monitor
Who can use it
Anyone who can see the page
Plan
Google Drive monitoring
For
Everyone

What the page is for

This page shows Google Drive activity from your Google Workspace audit reports: uploads, edits, deletions, moves, downloads, views and sharing changes. Each event shows when it happened, who did it, which document it affected, the operation, the person or group it was shared with (where relevant) and the IP address.

By default the page shows activity on Shared Drives only. Switch the scope to All Drive to include people's personal My Drive files. Quick filters take you straight to write, read or sharing activity, and External only shows activity involving people outside your organization.

A chart shows which people generated the most activity. Activity is collected automatically once Google Workspace is connected.

What you see

The Google Drive Monitor page, with the quick actions, activity by user, shared drive activity header, filters, quick filters and options and activity table numbered 1 to 6.
The Google Drive Monitor page. Numbers match the list below.
  1. Quick actions: Re-Authorize Google Workspace (or Connect Google Workspace if not connected).
  2. Activity by User: a collapsible chart of activity per person for the current filters.
  3. Shared Drive Activity header: the number of events.
  4. Filters: Search, Actor (user), Operations, Time and Scope (Shared Drives or All Drive).
  5. Quick filters and options: Write activities, Read activities, Sharing activities, All operations; External only; Hide service accounts; Jump to a date; Export; and reset.
  6. Activity table: Time, Actor, Document, Type, Operation, Target and IP, with Load more at the bottom.

How to find who changed or deleted a file

  1. Click Write activities.
  2. Type the file name in Search.
  3. If the file is in someone's My Drive, set Scope to All Drive.
  4. Widen Time if needed (24 hours, 7 days, 30 days, 90 days or All).

How to review sharing outside your organization

  1. Click Sharing activities.
  2. Tick External only.
  3. Review the Target column to see who each file was shared with. External people are marked with a badge.

How to investigate one person's activity

  1. Expand Activity by User to see who is most active.
  2. Choose the person in Actor (user).
  3. Click Read activities to look for unusual downloads or views.
  4. Use Jump to to go to a specific date.

How to export activity

  1. Set the filters you want.
  2. Click Export to download the activity as a file.

Tips

  • Keep Hide service accounts ticked to focus on people rather than automated accounts.
  • Your filters are remembered for each company in this browser. Click the reset button to return to the defaults.
  • Choose several Operations at once to build your own filter.
  • Use External Sharing to see what is currently shared outside, and this page to see when it happened and who did it.

Troubleshooting

  • "Google Workspace is not connected for this company." Click Connect Google Workspace and sign in as a Google Workspace administrator.
  • "No Shared Drive activity found for the selected filters." Switch Scope to All Drive, widen Time, or choose All operations.
  • A message says Lavawall can't yet tell which events belong to a Shared Drive. Switch to All Drive to see everything until that detail is available.
  • "No Drive activity found for the selected filters." Widen the filters or untick External only.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.