Update your Bookmarks to https://sites.google.com/view/gam--commands/home
From this page (https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-event-names) you can find the <Event_Name>.
This will show the events from the last 6 months.
gam report admin event "<Event_Name>"
Narrow down the results by including a date option, either a range, for example, range -9d -2d or start date, start <yyyy-mm-dd> and view the report in a Google Sheet with todrive.
The actor.email column shows the users who created the group.
gam report admin event create_group todrive
If you are looking to recover a deleted user, it has to be completed within 20 days of deletion. So adjust the start -20d accordinly or remove to see all deleted users within the stored records.
gam report admin event DELETE_USER start -20d todrive
Show Admin accounts that suspended users.
gam report admin event SUSPEND_USER
Or for a specific user who has been suspended.
gam report admin event SUSPEND_USER filter "USER_EMAIL==<Full Email Address>"
CHANGE_PASSWORD refers to Admin Changed passwords.
gam report admin event "CHANGE_PASSWORD" start <yyyy-mm-dd> todrive
CHANGE_PASSWORD refers to Admin Changed passwords.
gam report admin ou "</Path/To/OU>" event "CHANGE_PASSWORD" start <yyyy-mm-dd> todrive
All the fields for users created in the last 7 days.
gam report admin event CREATE_USER start -7d todrive
Limited fields, for users created since a specic date.
gam config csv_output_header_filter "USER_EMAIL,id.time,actor.email" report admin event CREATE_USER start <yyyy-mm-dd> todrive
gam report admin event "CHANGE_PASSWORD,CHANGE_FIRST_NAME,CHANGE_LAST_NAME" start -30d todrive
gam report admin start <yyyy-mm-dd> events CREATE_USER,DELETE_USER,UNDELETE_USER,SUSPEND_USER,UNSUSPEND_USER todrive
Report for the Domain (if single Domain) of emails sent & received for a date range.
gam report customer parameters gmail:num_emails_sent,gmail:num_emails_received range -8d -2d todrive
gam report user user <User Email Address> parameters gmail:num_emails_sent,gmail:num_emails_received range -30d -2d todrive
This command will list each day for each user.
gam report user select group <Group Email Address> parameters gmail:num_emails_sent,gmail:num_emails_received range <Start Date> <End Date> todrive
If you want to see only a row per day for the whole group (each users data added for each day) use this command.
gam report users select users testuser1,testuser2,testuser3 fields gmail:num_emails_received,gmail:num_emails_sent range <Start Date> <End Date> aggregatebydate todrive
To get the comma separated user details follow this process (Projects > AGGREGATE EMAILS RECEIVED AND SENT FOR A GROUP OF USERS) .
Report for the service Gmail, will have more columns that specifying parameters.
gam report user user <User Email Address> service gmail range -30d -14d todrive
gam report customer parameters gmail:num_emails_sent,gmail:num_emails_received,gmail:num_inbound_rejected_emails,gmail:num_inbound_spam_emails range -30d -2d todrive
Shared drives created since a specific date.
gam report drive events create start <yyyy-mm-dd> filter "doc_type==shared_drive" todrive
Shared drives created in the last 10 days.
gam report drive events create start -10d filter "doc_type==shared_drive" todrive
Activit for copy,download,print & view
gam report drive filter "shared_drive_id==<Shared Drive ID>" events copy,download,print,view todrive
gam report drive filter "doc_id==<DriveFileID>"
gam config csv_output_row_filter "accounts.*used_quota_in_mb:count>=15000" redirect csv ./BigUsers.csv report users select ou_ns </Path/To/OU> fields accounts:drive_used_quota_in_mb,accounts:used_quota_in_mb
config csv_output_row_filter "accounts.*used_quota_in_mb:count>=15000" - Filter for large values
redirect csv ./BigUsers.csv - Where to send the output
report users - Base command
select ou_ns </Path/To/OU> - Select non-suspended users in </Path/To/OU>
fields accounts:drive_used_quota_in_mb,accounts:used_quota_in_mb - Specific metrics
To view the results download or inspect, in the cloud (nano BigUsers.csv) the BigUsers.csv file. Alternatively add todrive to the end of the command to create a Google Sheet.
Or you could also have Google do the filtering:
gam redirect csv ./BigUsers.csv report users select ou_ns </Path/To/OU> fields accounts:drive_used_quota_in_mb,accounts:used_quota_in_mb filter "accounts:used_quota_in_mb>=15000" date -3d nodatechange
filter "accounts:used_quota_in_mb>=15000" - Filter for large values
date -2d nodatechange - Start two days back, the earliest that this data is available, but don't back up any further. Without nodatechange, GAM would keep backing up trying to get data for each user
Check a single user account
gam report user user <User Email Address> fulldatarequired all fields accounts:used_quota_in_mb,accounts:drive_used_quota_in_mb
These are the details shown when clicking on the Storage link in a users Drive.
gam report user user <User Email Address> todrive fulldatarequired all fields accounts:used_quota_in_mb,accounts:drive_used_quota_in_mb,accounts:gmail_used_quota_in_mb,accounts:gplus_photos_used_quota_in_mb
PASSWORD_EDIT refers to an event where the user changed the password.
gam report useraccounts ou </Path/To/OU> event PASSWORD_EDIT todrive
These paremeters can be used to report back on user access to Gmail. Bearing in mind that the data will not include the last 2 days.
gam report users select user <User Email Address> parameters gmail:last_webmail_time
gmail:last_access_time is a catch all for any activity on the account: active / passive requests, any protocols.
gmail:last_interaction_time is when we suspect that behind a request was a live user who initiated it explicitly and it might be a pop / imap / web request. There is complex classification logic behind it.
Accounts:last_login_time reflects login for the respective user account excluding logins performed via Single Sign On which in turn would be populated under accounts:last_sso_time
gmail:last_imap_time & gmail:last_pop_time these are timestamps for the last mail sync using imap and pop respecivly.
gmail:last_webmail_time that is designed to record the last time a user accessed their mailbox from webmail for example in a browser.
gam report domain fields gmail:num_30day_imap_users
gam report domain fields gmail:num_30day_pop_users
List the IP Addresses of sucessful login for a user
gam config csv_output_header_filter ipAddress report logins event login_success user <User Email Address>
gam report users select users <User Email Address> parameters accounts:last_login_time
gam print users lastlogintime todrive
gam print users lastlogintime query "orgUnitPath='/<OU Path>'"
Or, for the whole Domain, between 2 days prior and 8 days prior
gam report customer parameters lastLoginTime range -8d -2d todrive
An example based on running on 3rd December 2020. If combined with a scheduled task or cron job, this will produce an ongoing report with a new tab/sheet for each month.
gam report usage customer parameters meet:total_call_minutes,meet:total_meeting_minutes skipdaysofweek sat,sun previousmonths 1 todrive tdfileid <File ID> tdtitle "Meet Usage" tdtimeformat %Y-%m-%d tdaddsheet tdsheet "" tdsheettimeformat "%B %Y" tdsheetdaysoffset 6
gam report usage customer parameters meet:total_call_minutes,meet:total_meeting_minutes - The GAM command
skipdaysofweek sat,sun - exclude Sat & Sun, so only working days
previousmonths 1 - run against the previous months date range (regardless of how many days in the month, leap year etc)
todrive tdfileid <File ID> tdtitle "Meet Usage" tdtimeformat %Y-%m-%d - write the data to an existing Google Sheet and append with current date, so it will be called "Meet Usage - 2020-12-03"
tdaddsheet tdsheet "" - Add a new tab/sheet with no name
tdsheettimeformat "%B %Y" tdsheetdaysoffset 6 - give the new tab/sheet a time stamp backdated by 6 days of 'Month Year', so for this example "November 2020", which will become the name of the new tab/sheet. The offset number must take you back in time into the previous month.
You need to have already created the Google Sheet, to get the <File ID>. And tdtitle is not optional, although you should be able to specify "" (a blank name) if you just want the Google Sheet to show the updated date.
Show the total for all users for the last 28 (recorded) days
gam report usage customer parameters accounts:gplus_photos_used_quota_in_mb
To limit to the latest recorded day, add range -3d -2d on the end.
gam report usage customer parameters accounts:gplus_photos_used_quota_in_mb range -3d -2d
Create a Google Sheet with line for each user and latest figures, for the users in a Group
gam report user select group <Group Email Address> parameters accounts:gplus_photos_used_quota_in_mb todrive
Change the date as required.
gam report customer date 2020-03-07 todrive
Thanks to Jay Lee for posting this on the GAM Google Group.
Other parameters can be found here https://developers.google.com/admin-sdk/reports/v1/appendix/usage/customer/meet
Start Date: Change the start_date as required.
Skip Dates: Add the skipdates option and the date(s) as required.
single day skipdates yyyy-mm-dd
multiple days skipdates yyyy-mm-dd,yyyy-mm-dd
date range skipdates yyyy-mm-dd:yyyy-mm-dd
skipdaysofweek sat,sun
gam report usage customer parameters meet:total_call_minutes,meet:total_meeting_minutes start_date 2020-03-01 skipdaysofweek sat,sun todrive
a bit about this command, call minutes = 1 device joined to a meeting so 5 users on a 10 minute meeting = 50 call minutes, 2 users on 5 minute call = 10 call minutes and meeting minutes = length of actual meeting so 2 users on 10 minute meeting = 10 meeting minutes, 10 users on 10 minute meeting = 10 meeting minutes. I excluded weekend days when the organization was closed to avoid dramatic "camel humps" in the data.
gam report usage customer parameters classroom:num_1day_students,classroom:num_1day_teachers,classroom:num_student_posts_created,classroom:num_teacher_posts_created skip_days_of_week sat,sun start_date 2020-03-01 todrive
gam report usage customer parameters drive:num_collaborators,drive:num_consumers,drive:num_creators start_date 2020-01-01 todrive
gam report usage customer parameters cros:num_7day_active_devices,device_management:num_7day_total_managed_devices
This command will create a Google Sheet showing all the possible parameters. This sheet lists the parameters by service.
gam report usageparameters customer todrive
gam report user ou "</Path/To/OU>" parameters accounts:used_quota_in_mb
Or
gam report user ou "</Path/To/OU>" fields "accounts:used_quota_in_mb"
This command will record the times a user changes forwarding settings, such as adding forwarding address and enabling. But it will not record when email forwarding is disabled.
gam report useraccounts events email_forwarding_out_of_domain
The output lists the date & time the account was disabled.
gam config csv_output_row_filter "accounts:is_suspended:boolean:true" report user user all parameters accounts:is_suspended,accounts:disabled_reason todrive
Run this report to gather all the field names (column headers) to then work out the syntax to enter into the specific fields report.
gam report user user <user email address> todrive fulldatarequired all
Or, for only active users use query "isSuspended=False". For example for limited info on all current users
gam print users query "isSuspended=False" orgUnitPath primaryEmail firstname familyname todrive
gam report user user <user email address> parameters <fields,separated,by,commas> date <yyyy-mm-dd>
gam report user user <user email address> parameters accounts:drive_used_quota_in_mb,accounts:gmail_used_quota_in_mb date <yyyy-mm-dd>
gam report users parameters accounts:is_disabled,accounts:total_quota_in_mb,accounts:used_quota_in_mb,accounts:used_quota_in_percentage fulldatarequired accounts todrive
To run a report on all the users, you need to select a date a few days prior to the current date
gam report users parameters accounts:drive_used_quota_in_mb,accounts:gmail_used_quota_in_mb date <yyyy-mm-dd> todrive
gam report login todrive start <yyyy-mm-dd>
The date -6d is needed as Google does not have info before this date
gam report users filter 'accounts:is_less_secure_apps_access_allowed==TRUE' date -6d todrive
OR
gam report users date -6d todrive parameters accounts:is_less_secure_apps_access_allowed
gam config csv_output_row_filter "'accounts.last_login_time:regex:Never','accounts.used_quota_in_mb:count=0'" redirect csv ./NoLoginQuotaUsers.csv report users ou "</Path/To/OU>" fields "accounts:timestamp_last_login,accounts:used_quota_in_mb" todrive
gam report user user <User Email Address> parameters accounts:disabled,accounts:disabled_reason
gam redirect csv ./UserInfo.csv report users ou "</Path/To/Top/OU>" showorgunit parameters accounts:drive_used_quota_in_mb,accounts:total_quota_in_mb,accounts:used_quota_in_mb,accounts:used_quota_in_percentage,accounts:is_suspended todrive
Dates can be specified as -10d. Maximum held is 400 days.