How to Filter Log Records in gPanel

In a complex Google Workspace environment, maintaining visibility into "who did what and when" is a cornerstone of effective domain governance.

gPanel’s Logging module provides a comprehensive audit trail of every action taken within the platform. Whether you are troubleshooting a configuration change or performing a forensic security review, these logs offer a granular view of your administrative activity.

Real-World Use Cases for Audit Logs

Understanding when and why to pull logs helps administrators stay proactive:

• Troubleshooting Unauthorized Access: If a user reports unexpected access to a Shared Drive, an admin can filter by the "Drive" permission and the "Target User" to see who modified the permissions.

• Onboarding/Offboarding Verification: During an audit, you may need to prove that a former employee's account was suspended and their data was transferred. Filtering by the "Action" and "Date Range" provides the necessary documentation.

• Change Management Tracking: If a domain-wide setting (like a gPanel Contact Sync) was accidentally deleted, logs help identify the "Performing User" to provide training or prevent future errors.

• Compliance & Legal Requests: For organizations subject to HIPAA, GDPR, or SOC2, the ability to export a historical "Date/Time Range" of administrative actions is essential for satisfying external auditors.

Run a search

1. Navigate to the Logging module in the left-hand menu. 

2. Use the four primary filter fields at the top of the page to define your search:

   1. Performing User: Filter by the user who initiated the action.

   2. Target User: Filter by the end-user who was affected by the action (e.g., the user whose password was reset).

   3. Permission Required: Filter by the specific action that occurred. Actions are divided by module — such as Drive, Administration, Calendars, Rule Engine, Directory, and Tools — allowing you to isolate specific types of activity.
      

   4. Date/ Time Range: Define the exact window in which the event occurred.
      

3. To remove a filter, simply click the X next to it. 
   
   

4. Once your criteria are set, click the Search button to populate the results table.

Export logs

1. After running your search, click Export.
   

2. The system will automatically generate a spreadsheet in the Google Drive of the logged-in user.

3. You will be redirected to a new tab containing the exported data, which includes the Created Date, Time of Action, Performing User, and the specific Action/Target details.