How to understand the Drive log event 'Google System deleted an item'

Problem

When you check the Drive log events located in the Reporting section in the Admin console, they have deleted log events that show Google System deleted an item in the description column.

Environment

  • Reporting
  • Drive log events

Solution

To confirm who sent the file to the trash originally, that triggered the deletion by the system:
  1. Go to the Reporting section in your Admin console.
  2. Select Drive log events.
  3. Click on + Add a filter > select Document ID.
  4. Type the Document ID of the file that shows as deleted by Google System > click Apply > Search.
Note: You will see both events one for the file being trashed and the other for the deletion done by the system automatically after 30 days.

 

Cause

When you send a Drive file to the trash, it will remain there for a period of 30 days, then the system deletes the file permanently. When this happens, a Drive log event appears with this description Google System deleted an item, because the deletion action was made by Google System and not by the user manually. More details are found in the Drive log events article.