How to Investigate Keep Activity With the Google Workspace Keep Audit Log

Quick and easy-to-follow guide for Google Workspace administrators

What is the Google Keep Audit Log feature in Google Workspace

The Keep audit log shows you actions performed by Google Workspace in Google Keep in the past 180 days, such as creating, deleting, and sharing notes.

When to use the Google Keep Audit Log

When you want to investigate any Google Keep-related activity

Google Keep Audit Log data availability and retention

After an action is performed, the log updates and reflects it quite fast, almost in real-time, but can take up to 1-3 days.
In very rare cases, events may not be reported at all.
The log only shows data from the last 180 days.
Data older than 180 days gets permanently removed from the log.

How to use the Google Keep Audit Log step-by-step with images

Step 1

Go to the Admin console https://admin.google.com and in the menu on the left, click Reporting > Audit > Keep.

Step 2

By default, you will see all Google Keep-related actions sorted chronologically from newest to oldest, under Event Name, Event Description, etc.

You can narrow down the scope of the filter to find something specific by clicking the Add a filter option on the left.

Step 3

Clicking Add a filter lets you only display events related to the type of thing you want to search for.

Event name is the type of event you are looking for, such as adding or deleting a note.
User name is the name or email address of the user who performed the event.
Owner shows the owner of the note.
Note URI is the unique identifier of the note.
Attachment URI is the unique identifier of any attachments.

Step 4

There are more filters on the top right.

Clicking the Organizational unit filter allows you to only view events related to users in a specific OU.

Step 5

Clicking the Group filter on the top right allows you to only view events related to users in specific Google Groups that you have set as filtering groups. To set a group as a filtering group, you can click the Filtering groups link.

Step 6

The Date range filter lets you display events that occurred in a specific time frame. Again, please note that it’s impossible to go further than the last 6 months.

Step 7

The gear icon Manage columns on the right lets you add or remove columns that show info in the report.

Step 8

You can also rearrange them by clicking and holding the left mouse button on the left of the column name and dragging it up or down.

Step 9

The Download icon is for exporting data from the audit log.

Step 10

You can export to a Google Sheets file or a .csv file, and you can export All columns or only the Currently selected columns.

Unless you prefer or need .csv for a specific reason, you should select Google Sheets.

Step 11

When the export is ready, you’ll be able to see it under the Tasks icon on the top right. Click Open in Google Sheets to view the report in a spreadsheet.

That's all! You reached the end of the article. Continue to:

If you find this useful, share and help others!

Email Log Search: Get Details About Message Delivery

Track and get details about outgoing and incoming emails of users in your account.

View the Google Workspace Admin Actions Log

Access information related to all administrator activity in your Google Admin console.

View the User Login Events Log

Access information related to the login activity of users in your account.

View the Google Drive Events Log

Access information related to the Google Drive activity of users in your account.

View the Google Calendar Events Log

Access information related to the Google Calendar activity of users in your account.

View the Google Groups Events Log

Access information related to Google Groups activity in your account.

View the Google Chat Events Log

Access information related to the Google Chat activity in your account.

View the Google Meet Events Log

Access information related to the Google Meet activity of users in your account.

View the Google Takeout Events Log

Access information related to the Google Takeout activity of users in your account.

View the Mobile Device Events Log

Access information related to the mobile device activity of users in your account.

View the OAuth Token Events Log

Access information related to third-party app authorization by users in your account.

View the SAML App Events Log

Access information related to the SAML app login activity of users in your account.

View the Google Keep Events Log

Access information related to the Google Keep activity of users in your account.

View the Google Currents Events Log

Access information related to Google Currents activity of users in your account.

Protect And Secure Google Workspace

Backup and protect your data

Data protection and security tools are crucial, especially if you store any sensitive data in your accounts.

See recommendations

Email Marketing Tools

Better Gmail and email marketing

If you work with Gmail or do email marketing, you will appreciate what these services can do for you.

See recommendations

Collab And Optimization Tools

Process optimization and collaboration

You can use these services to make tedious processes a whole lot easier, improve teamwork, save time, and get better results.

See recommendations

Website Tools and Resources

Resources for website creators

Awesome tools and services for easy and effective site building, content creation, SEO, email marketing, and more.

See recommendations