您可以使用Reports API 中的activities.list 访问包含查看日志活动和其他事件的云端硬盘审核日志。请参阅Drive Audit Activity Events 了解可用事件列表。
使用管理控制台的示例:
示例activities.list请求参数:
userKey: all
applicationName: drive
eventName: view
filters: doc_id==13NgKy87BggedOXnmkymygTyEh0xxxxxxxx
示例响应:(删除了一些敏感信息)
{
"kind": "admin#reports#activities",
"etag": "\"gwJsVSTi6OzvUGrf7ei0V53d9qZWZz_Kvb9LYWitNI4/sGVnptbK063qxxxxxx\"",
"items": [
{
"kind": "admin#reports#activity",
"id": {
"time": "2021-03-24T18:49:24.579Z",
.....
},
"actor": {
"email": "user1@domain.com",
"profileId": "1043405157872289xxxxx"
},
"events": [
{
"type": "access",
"name": "view",
......
}
]
},
{
"kind": "admin#reports#activity",
"id": {
"time": "2021-03-24T18:49:01.942Z",
.....
},
"actor": {
"email": "rm@domain.com",
"profileId": "1146312647848028xxxxx"
},
"ipAddress": "110.54.238.28",
"events": [
{
"type": "access",
"name": "view",
......
}
]
},
{
"kind": "admin#reports#activity",
"id": {
"time": "2021-03-24T18:48:29.751Z",
.....
},
"actor": {
"email": "",
"profileId": "1052505060979797xxxxx"
},
"events": [
{
"type": "access",
"name": "view",
......
}
]
},
{
"kind": "admin#reports#activity",
"id": {
"time": "2021-03-24T18:47:30.288Z",
.....
},
"actor": {
"email": "rm@domain.com",
"profileId": "1146312647848028xxxxx"
},
"ipAddress": "110.54.238.28",
"events": [
{
"type": "access",
"name": "view",
......
}
]
},
{
"kind": "admin#reports#activity",
"id": {
"time": "2021-03-22T21:17:35.009Z",
.....
},
"actor": {
"email": "rm@domain.com",
"profileId": "114631264784802xxxxx"
},
"events": [
{
"type": "access",
"name": "view",
......
}
]
}
]
}
注意:
- 如果文件被贵组织外部的用户查看,则电子邮件地址将不可用(用户是匿名的)
- 驱动器审核日志的数据保留时间为 6 个月。您可以在此之前访问云端硬盘审核日志数据。您可能需要考虑每月保存一次数据计数,这样即使以前的驱动器审核日志被删除,您仍然可以保留这些数据。
参考资料: