Filter and export activity
Choose a time range, filter operations by action and result, search by resource or user, read operation details, and export a page as CSV.
Use the Activity Log page to find the operations that matter, read why one failed, and save a page of them as a CSV file.
Before you begin
You need any role with Read access to Audit Log on the project or its subscription, such as Owner, Contributor, or Reader. The Billing Operator role doesn't have it.
Choose a time range
In the console, go to Activity log.
Next to Operation volume, select 1h, 24h, 7d, or 30d. The default is 30d.
The chart shows the operations of the range by result: one bar per hour for 1h and 24h, and one bar per day for 7d and 30d. Next to the title, the counts of the whole range: all events, ok, failed, and pending.
The first page refreshes every 30 seconds, so new operations appear while you watch.
Filter and search
To show one action, select it in the All actions list.
To show one result, select Success, Failure, or Pending in the Any result list.
To search, type in the search box. The list updates when you stop typing.
To remove every filter and return to the last 30 days, select Clear filters.
| Control | How it works |
|---|---|
| All actions | Lists the action IDs of the operations on the current page, such as compute.instance.create. The filter itself applies to the whole range. |
| Any result | Narrows the list. The chart and the counts still show every result, so you can compare. |
| Search | Matches part of the action ID, the resource type, ID, or name, or the actor's ID, name, or email address. Upper and lower case don't matter. |
Read an operation
Each row shows:
- the time when the operation finished, or its last update while it runs, in your account's time zone;
- the action as a sentence, such as "Snapshot created". For a failed operation, the reason and the error code are shown under it;
- the resource. Select it to open the resource's page, when it has one;
- the actor: the user's name, with the email address when you point at it. An actor that isn't a user of your organization shows its ID, and the platform's own operations show system;
- the result.
To see more, select the row. It expands to show the operation ID, the action ID, the service, how long ago the operation happened, and the operation's full record as JSON. The record also contains the IP address that the request came from.
The list is sorted from newest to oldest, 50 operations per page. Use Previous and Next to page through it.
Export a page
Set up the range, the filters, and the page that you want.
Select Export page (CSV).
The browser downloads the operations of the page on screen, up to 50, as a CSV file named after the subscription, the range, and the page, for example activity-<subscription-id>-30d-p1.csv. <subscription-id> is the ID of your subscription. To export more operations, export each page.
| Column | Content |
|---|---|
timestamp | The time shown in the list, in UTC, in ISO 8601 format. |
action | The action ID. |
service | The service, such as Compute or Storage. |
resource | The resource's name, or its ID. |
actor, actorEmail | The actor as shown in the list, and the user's email address. |
result | Success, Failure, or Pending. |
operationId | The operation ID. |
errorCode, errorMessage | The failure's code and reason, for a failed operation. |
To read the activity through the REST API, with your own time range, see GET/scopes/{scopeId}/activity/activity-events.
Result
The list shows the operations of your range and filters, and the file contains the page that you exported.
Troubleshooting
| Message | Cause | Resolution |
|---|---|---|
| No matching activity | No operation in the range matches the filters. | Select a longer range, or Clear filters. |
| Couldn’t load activity | The activity feed didn't respond. | Select Retry. |
An action that you expect isn't listed if it's older than the range, if it ran in another project, or if it doesn't run as an operation. See What is Activity Log?.