Troubleshoot the Google Workspace Beat

This guide provides solutions for common issues with the Google Workspace Beat.

Data Missing from Delayed Log Event Names

Google Workspace logs sometimes see documented delays within Google, which prevent the collection of near-real time data for certain Log Event Names; more information on this issue is available on the Google Support website. To alleviate this issue, LogRhythm has added the ability to delay the collection of this data.

If data resiliency is required for this log source, the recommended approach is to configure multiple Google Workspace beats, where one collects the near-real time Log Event Names and one collects delayed Log Event Names. The majority of the Auth/Login Log Event Names can be delayed up to a few hours.

To configure the delay on your Google Workspace Beat, perform the following steps:

Run the following command:

CODE

./lrctl gsbeat config export --outfile gsbeatconfig.yml

Run the following command to open the Google Workspace configuration file:

CODE

vim gsbeatconfig.yml

Increase the "delayedTimeMin:" value and save the updated configuration file.
Run the following commands:

CODE

cat gsbeatconfig.yml | ./lrctl gsbeat config import

Run the following command to complete importing the updated configuration file:

CODE

rm gsbeatconfig.yml

Restart the Google Workspace Beat:

CODE

./lrctl gsbeat restart

Check the logs to see if the issue has been resolved:

CODE

./lrctl gsbeat logs

In cases where the system experiences data loss or delays in receiving login, admin, or token logs, the PubSub Beat can be also used to collect and parse Google Workspace login, admin, and token logs efficiently; however, this carries some additional cost on the GCP side.

Data Missing from Delayed Log Event Names

Login, Admin, and Token Logs Delayed or Missing