Email deleting audit

[JacePeng]

Is there a way to audit the user's email deleting? We want to audit the user's email deleting behavior. Ask support seems there is no way to do so.

[AlanM]

If you have Google Business Plus or higher, you can use Vault, to get delete history and the infer behaviour from that.

[JacePeng]

Yes. I've try to use https://vault.google.com/ to do so. Seems no able to get the log. If sure there any mistake i made or not. Also google support told me gmail didn't provide any logging about user email deleting.

[Jan-Carlos · Accepted solution]

Hello!

I don't know if this can help you with your solicitation, but you can use the investigation tool to see the event of a user moving messages to bin:

And you can also set an alert to send you a message when this happens.

[JacePeng]

Great. Thank you. 

[fnyr_admin]

I cannot find this feature. I'm not sure if you're referring to an Admin function here or a User function. If an Admin function, is this function now found in Reporting > Audit and investigation > Add filter > etc.? If so, under User log events, there is no event for "Move to bin" (or similar). I don't find any Investigative function at all in the User's Security menu, so I think you must be referring to an Admin function. Would like some help in finding where this is, it seems to have been moved, and/or the options changed. Thanks. 

[David_Wong]

Just checking, how come I don't have the Gmail log events in the selections?

[rajdumbare]

I was also looking for the log for a particular user who is already using a Business Standard license & I need to retrieve its "Message Deleted", "Email Deleted", or "Moved to Bin/Trash" logs. There is no option in the Audit or anywhere in the Admin panel.

[mjbisonok]

You need to go to Directory>Users. Choose the user you want to view logs for, and then select the "Investigate" tab at the top of the page. It should allow you to "Check log events for issues related to this user" and "Audit logs related to this user". You can then choose "Gmail log events" under "Audit logs related to this user" and then it will let you filter what you need to retrieve.

[KevinApodaca]

You need to have Enterprise Plus license to be able to see that "gmail log events" data source in the admin console.

[carlosiping]

I'm trying to investigate using a domain that I administer, my account is adm, but it doesn't show 'gmail log events', is there any other alternative to investigate the deleted email?

[KevinApodaca]

See my response above, if you do not have Google Workspace Enterprise Plus license you will not see Gmail Log Events in the Security Investigation Tool.

Alternatively you may consider something programmatic via the Reports API and/or Gmail API

[ACCTJohn]

Would love some guidance on this. I have a user who is missing emails. I find them in Vault, but they can't find them by searching their inbox... my assumption is they've been deleted (though they are not in the trash) and gmail logs would seem to be very helpful in finding these emails or actions taken on them, but our license is only Business Plus.