Reports

Event Name

From this page (https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-event-names) you can find the <Event_Name>.

Basic Command

This will show the events from the last 6 months. 

gam report admin event "<Event_Name>"

Narrow down the results by including a date option, either a range, for example, range -9d -2d or start date, start <yyyy-mm-dd> and view the report  in a Google Sheet with todrive.

CREATE_GROUP

The actor.email column shows the users who created the group.

gam report admin event create_group todrive

Deleted Users

If you are looking to recover a deleted user, it has to be completed within 20 days of deletion. So adjust the start -20d accordinly or remove to see all deleted users within the stored records.

gam report admin event DELETE_USER start -20d todrive

Suspended Users

Show Admin accounts that suspended users.

gam report admin event SUSPEND_USER

Or for a specific user who has been suspended.

gam report admin event SUSPEND_USER filter "USER_EMAIL==<Full Email Address>"

Password Changed

CHANGE_PASSWORD refers to Admin Changed passwords.

gam report admin event "CHANGE_PASSWORD" start <yyyy-mm-dd> todrive

Password Changed By OU

CHANGE_PASSWORD refers to Admin Changed passwords.

gam report admin ou "</Path/To/OU>" event "CHANGE_PASSWORD" start <yyyy-mm-dd> todrive

User Created

All the fields for users created in the last 7 days.

gam report admin event CREATE_USER start -7d todrive

Limited fields, for users created since a specic date.

gam config csv_output_header_filter "USER_EMAIL,id.time,actor.email" report admin event CREATE_USER start <yyyy-mm-dd> todrive

Password and/or Name Change

gam report admin event "CHANGE_PASSWORD,CHANGE_FIRST_NAME,CHANGE_LAST_NAME" start -30d todrive

Multiple Events

gam report admin start <yyyy-mm-dd> events CREATE_USER,DELETE_USER,UNDELETE_USER,SUSPEND_USER,UNSUSPEND_USER todrive

Domain Report

Report for the Domain (if single Domain) of emails sent & received for a date range.

gam report customer parameters gmail:num_emails_sent,gmail:num_emails_received range -8d -2d todrive

User report

gam report user user <User Email Address> parameters gmail:num_emails_sent,gmail:num_emails_received range -30d -2d todrive

Group Report

This command will list each day for each user.

gam report user select group <Group Email Address> parameters gmail:num_emails_sent,gmail:num_emails_received range <Start Date> <End Date> todrive

If you want to see only a row per day for the whole group (each users data added for each day) use this command.

gam report users select users testuser1,testuser2,testuser3 fields gmail:num_emails_received,gmail:num_emails_sent range <Start Date> <End Date> aggregatebydate todrive

To get the comma separated user details follow this process (Projects > AGGREGATE EMAILS RECEIVED AND SENT FOR A GROUP OF USERS) .

User report of service

Report for the service Gmail, will have more columns that specifying parameters.

gam report user user <User Email Address> service gmail range -30d -14d todrive

SPAM & Rejected emails

gam report customer parameters gmail:num_emails_sent,gmail:num_emails_received,gmail:num_inbound_rejected_emails,gmail:num_inbound_spam_emails range -30d -2d todrive

Shared Drive Creation

Shared drives created since a specific date.

gam report drive events create start <yyyy-mm-dd> filter "doc_type==shared_drive" todrive

Shared drives created in the last 10 days.

gam report drive events create start -10d filter "doc_type==shared_drive" todrive

Activity

Activit for copy,download,print & view

gam report drive filter "shared_drive_id==<Shared Drive ID>" events copy,download,print,view todrive

Doc_Id

gam report drive filter "doc_id==<DriveFileID>"

Non-Suspended Users With Drive over 15Gb

gam config csv_output_row_filter "accounts.*used_quota_in_mb:count>=15000" redirect csv ./BigUsers.csv report users select ou_ns </Path/To/OU> fields accounts:drive_used_quota_in_mb,accounts:used_quota_in_mb

• config csv_output_row_filter "accounts.*used_quota_in_mb:count>=15000" - Filter for large values

• redirect csv ./BigUsers.csv - Where to send the output

• report users - Base command

• select ou_ns </Path/To/OU> - Select non-suspended users in </Path/To/OU>

• fields accounts:drive_used_quota_in_mb,accounts:used_quota_in_mb - Specific metrics

To view the results download or inspect, in the cloud (nano BigUsers.csv) the BigUsers.csv file. Alternatively add todrive to the end of the command to create a Google Sheet.

Or you could also have Google do the filtering:

gam redirect csv ./BigUsers.csv report users select ou_ns </Path/To/OU> fields accounts:drive_used_quota_in_mb,accounts:used_quota_in_mb filter "accounts:used_quota_in_mb>=15000" date -3d nodatechange

filter "accounts:used_quota_in_mb>=15000"  - Filter for large values

date -2d nodatechange - Start two days back, the earliest that this data is available, but don't back up any further. Without nodatechange, GAM would keep backing up trying to get data for each user

Total &Drive

Check a single user account

gam report user user <User Email Address> fulldatarequired all fields accounts:used_quota_in_mb,accounts:drive_used_quota_in_mb

Total, Drive, Gmail & Photos

These are the details shown when clicking on the Storage link in a users Drive.

gam report user user <User Email Address> todrive fulldatarequired all fields accounts:used_quota_in_mb,accounts:drive_used_quota_in_mb,accounts:gmail_used_quota_in_mb,accounts:gplus_photos_used_quota_in_mb

PASSWORD_EDIT for OU

PASSWORD_EDIT refers to an event where the user changed the password.

gam report useraccounts ou </Path/To/OU> event PASSWORD_EDIT todrive

Parameters

These paremeters can be used to report back on user access to Gmail. Bearing in mind that the data will not include the last 2 days.

gam report users select user <User Email Address> parameters gmail:last_webmail_time

gmail:last_access_time is a catch all for any activity on the account: active / passive requests, any protocols.
gmail:last_interaction_time is when we suspect that behind a request was a live user who initiated it explicitly and it might be a pop / imap / web request. There is complex classification logic behind it.
Accounts:last_login_time reflects login for the respective user account excluding logins performed via Single Sign On which in turn would be populated under accounts:last_sso_time
gmail:last_imap_time & gmail:last_pop_time these are timestamps for the last mail sync using imap and pop  respecivly.
gmail:last_webmail_time that is designed to record the last time a user accessed their mailbox from webmail for example in a browser.

30 Day Users

gam report domain fields gmail:num_30day_imap_users

gam report domain fields gmail:num_30day_pop_users

List of IP Address for Login Succcess

List the IP Addresses of sucessful login for a user

gam config csv_output_header_filter ipAddress report logins event login_success user <User Email Address>

Single User

gam report users select users <User Email Address> parameters accounts:last_login_time

All Users

gam print users lastlogintime todrive

An OU

gam print users lastlogintime query "orgUnitPath='/<OU Path>'"

Or, for the whole Domain, between 2 days prior and 8 days prior

gam report customer parameters lastLoginTime range -8d -2d todrive

Example

An example based on running on 3rd December 2020. If combined with a scheduled task or cron job, this will produce an ongoing report with a new tab/sheet for each month.

gam report usage customer parameters meet:total_call_minutes,meet:total_meeting_minutes skipdaysofweek sat,sun previousmonths 1 todrive tdfileid <File ID> tdtitle "Meet Usage" tdtimeformat %Y-%m-%d tdaddsheet tdsheet "" tdsheettimeformat "%B %Y" tdsheetdaysoffset 6

Breakdown

• gam report usage customer parameters meet:total_call_minutes,meet:total_meeting_minutes - The GAM command

• skipdaysofweek sat,sun - exclude Sat & Sun, so only working days

• previousmonths 1 - run against the previous months date range (regardless of how many days in the month, leap year etc)

• todrive tdfileid <File ID> tdtitle "Meet Usage"  tdtimeformat %Y-%m-%d - write the data to an existing Google Sheet and append with current date, so it will be called "Meet Usage - 2020-12-03"

• tdaddsheet tdsheet "" - Add a new tab/sheet with no name

• tdsheettimeformat "%B %Y" tdsheetdaysoffset 6 - give the new tab/sheet a time stamp backdated by 6 days of 'Month Year', so for this example "November 2020", which will become the name of the new tab/sheet. The offset number must take you back in time into the previous month.

Notes

You need to have already created the Google Sheet, to get the <File ID>. And tdtitle is not optional, although you should be able to specify "" (a blank name) if you just want the Google Sheet to show the updated date.

All Users

Show the total for all users for the last 28 (recorded) days

gam report usage customer parameters accounts:gplus_photos_used_quota_in_mb

To limit to the latest recorded day, add range -3d -2d on the end.

gam report usage customer parameters accounts:gplus_photos_used_quota_in_mb range -3d -2d

Group

Create a Google Sheet with line for each user and latest figures, for the users in a Group

gam report user select group <Group Email Address> parameters accounts:gplus_photos_used_quota_in_mb todrive

Specific date

Change the date as required.

gam report customer date 2020-03-07 todrive

Thanks to Jay Lee for posting this on the GAM Google Group.

Other parameters can be found here https://developers.google.com/admin-sdk/reports/v1/appendix/usage/customer/meet

Start Date: Change the start_date as required.

Skip Dates: Add the skipdates option and the date(s) as required.

• single day skipdates yyyy-mm-dd

• multiple days skipdates yyyy-mm-dd,yyyy-mm-dd

• date range skipdates yyyy-mm-dd:yyyy-mm-dd

• skipdaysofweek sat,sun

Google Meet

gam report usage customer parameters meet:total_call_minutes,meet:total_meeting_minutes start_date 2020-03-01 skipdaysofweek sat,sun todrive

a bit about this command, call minutes = 1 device joined to a meeting so 5 users on a 10 minute meeting = 50 call minutes, 2 users on 5 minute call = 10 call minutes and meeting minutes = length of actual meeting so 2 users on 10 minute meeting = 10 meeting minutes, 10 users on 10 minute meeting = 10 meeting minutes. I excluded weekend days when the organization was closed to avoid dramatic "camel humps" in the data.

Google Classroom

gam report usage customer parameters classroom:num_1day_students,classroom:num_1day_teachers,classroom:num_student_posts_created,classroom:num_teacher_posts_created skip_days_of_week sat,sun start_date 2020-03-01 todrive

Google Drive 

gam report usage customer parameters drive:num_collaborators,drive:num_consumers,drive:num_creators start_date 2020-01-01 todrive

Chromebook vs Mobile

gam report usage customer parameters cros:num_7day_active_devices,device_management:num_7day_total_managed_devices

All Parameters

This command will create a Google Sheet showing all the possible parameters. This sheet lists the parameters by service.

gam report usageparameters customer todrive

Account useage for OU

gam report user ou "</Path/To/OU>" parameters accounts:used_quota_in_mb

Or

gam report user ou "</Path/To/OU>" fields "accounts:used_quota_in_mb"

email_forwarding_out_of_domain

This command will record the times a user changes forwarding settings, such as adding forwarding address and enabling. But it will not record when email forwarding is disabled.

gam report useraccounts events email_forwarding_out_of_domain

Accounts Disabled Time

The output lists the date & time the account was disabled.

gam config csv_output_row_filter "accounts:is_suspended:boolean:true" report user user all parameters accounts:is_suspended,accounts:disabled_reason todrive

Report of all fields for a given user

Run this report to gather all the field names (column headers) to then work out the syntax to enter into the specific fields report.

gam report user user <user email address> todrive fulldatarequired all

Or, for only active users use query "isSuspended=False". For example for limited info on all current users

gam print users query "isSuspended=False" orgUnitPath primaryEmail firstname familyname todrive

Report with selected fields for a specific user

gam report user user <user email address> parameters <fields,separated,by,commas> date <yyyy-mm-dd>

gam report user user <user email address> parameters accounts:drive_used_quota_in_mb,accounts:gmail_used_quota_in_mb date <yyyy-mm-dd>

Report with selected fields for a all users

gam report users parameters accounts:is_disabled,accounts:total_quota_in_mb,accounts:used_quota_in_mb,accounts:used_quota_in_percentage fulldatarequired accounts todrive

Report on all users showing Drive & Gmail quota in MB 

To run a report on all the users, you need to select a date a few days prior to the current date 

gam report users parameters accounts:drive_used_quota_in_mb,accounts:gmail_used_quota_in_mb date <yyyy-mm-dd> todrive

Login activity from a set date

gam report login todrive start <yyyy-mm-dd>

With Less Secure Apps

The date -6d is needed as Google does not have info before this date

gam report users filter 'accounts:is_less_secure_apps_access_allowed==TRUE' date -6d todrive

OR

gam report users date -6d todrive parameters accounts:is_less_secure_apps_access_allowed

Specific OU, with 0Mb storage used, and has never logged in

gam config csv_output_row_filter "'accounts.last_login_time:regex:Never','accounts.used_quota_in_mb:count=0'" redirect csv ./NoLoginQuotaUsers.csv report users ou "</Path/To/OU>" fields  "accounts:timestamp_last_login,accounts:used_quota_in_mb" todrive

User Suspended Date

gam report user user <User Email Address> parameters accounts:disabled,accounts:disabled_reason

gam redirect csv ./UserInfo.csv report users ou "</Path/To/Top/OU>" showorgunit parameters accounts:drive_used_quota_in_mb,accounts:total_quota_in_mb,accounts:used_quota_in_mb,accounts:used_quota_in_percentage,accounts:is_suspended todrive