'Remove Room Member' audit logs

Problem

Unable to find the members removed from the Remove Room Member Event in the Chat audit log. The Chat Space audit log does not provide the customer with detailed information regarding the Remove Room Member Event, such as who was removed. The information only shows the event and the actor that performed the action:
 
EventEvent DescriptionActorDate
Remove Room Member  <Actor> removed a room member  <Actor>x.x.x.x

Environment

Investigation tool only available for:
  • Enterprise
  • Education Standard
  • Education Plus

Solution

  1. Use the investigation tool  and run the following searches:
    • Data source: Chat
    • AND
    • Room ID Contains <Room ID>
      • The Room ID can be found within the space URL, the last numbers after '/space/' are the Room ID. For example:
        https://mail.google.com/chat/u/0/#chat/space/XXXX - XXXX
    • Event is Room member removed
    • Click Search and export your findings
Note: The Recipients represent the users removed from the space.