Does anyone have an idea on how to collect google workspace logs?

[Benjamin_Hummel]

Trouble connecting to Google Workspace
Hi, we created a connection to our Google Workspace account using the official instructions . All were configured with the same credentials, but still 2 out of the 6 feeds are marked as "Failed" (Workspace Activities and Workspace Privileges). I will give more details in the thread, to not spam the channel too much. Does anyone have an idea, what could be wrong?

[Benjamin_Hummel]

For the "Workspace Activities" I get this error:

View files in slack

[Benjamin_Hummel]

I am wondering if I misconfigured the Applications field for this feed. Is there maybe some special value that just indicates "all"?

[Benjamin_Hummel]

For the "Workspace Privileges" I get this error:

View files in slack

[Benjamin_Hummel]

This sounds like some permission is missing. Are there known issues in the documentation that I linked above?

[cmmartin_google]

If 4/6 worked then you can infer the credentials are good. For Privileges that, unfortunately, requires Super Admin access! I don't recommend bringing that log source in as it has very little value, that and you don't want to be making a service account have that level of IAM permission (there is no API role in Workspace unfortuantely)

[cmmartin_google]

for the Activities, I would try with a small subset (maybe one) application. Does it give the same error? If other GSuite integrations are working ok (and collecting logs?) it would be the first thing I'd try to troubleshoot.

[cmmartin_google]

The other alternative, via a support ticket they can give you a more detailed error log from the backend, but that may take a little while to get back

[Benjamin_Hummel]

Thanks a lot for your comments. As we are just getting started, I will definitely skip the Privileges feed. The Activities feed is now working, when choosing only two of the available applications. I will see how far I get there by trial and error, given that the documentation seems to be flawed.

[Ion_Todd]

What have you got in your applications field?

[adam9]

If you want to live on the bleeding edge, we have a private preview for a new Workspace Activities ingestion pipeline. It doesn’t require a feed to be set up.

[Roberto_Del]

Just wanted to say thank you because we had the same error for the "Workspace Privileges" and we didn't know it required those privileges. We will evaluate if it's worth it or not.

[Benjamin_Hummel]

@Ion_Todd we are now running with just login and drive and this works. Before I had the full list from the docs.

[Benjamin_Hummel]

@adam9 bleeding edge sounds good. What would be next steps for this?

[adam9]

You can sign up here for the preview here: https://forms.gle/GVSy1wUzHYX6Emdj6