Workspace Admin · Domain 6 of 6

Workspace Admin Domain 6: Monitoring and troubleshooting common issues

This section covers finding and fixing problems: reading audit logs, checking the Workspace Status Dashboard, tracing mail with Email Log Search and headers, recovering deleted data, using reports, and gathering logs before opening a support case.

Exam weight
~13%
Official objectives
4
Estimated questions estimate
7
Suggested study time estimate
7–10 hrs

About 12 min read Reviewed October 2026

Overview

Section 6 is about 13% of the exam and tests whether you can move from a user's complaint to a cause and a fix. It covers four objectives: identifying and diagnosing issues with audit logs and the Workspace Status Dashboard, troubleshooting common problems across accounts, Gmail, Calendar, Drive and Meet, using reports and audit logs to monitor the environment, and making good use of Google's support resources.

Many questions centre on mail. You should know when to use Email Log Search, how to read SPF, DKIM and DMARC results in a message header with the Google Admin Toolbox, and how long settings changes can take to apply. Others cover restoring deleted Drive files and Gmail messages, Calendar sync with Outlook, Drive for desktop, Meet quality, and the logs and HAR files Google Support will ask for.

How it's tested

Section 6 questions start with a symptom and ask for the first or best diagnostic step, or the tool that confirms the cause. Read the timeline carefully: a recent settings change, a reported outage, or a deletion within a recovery window often decides the answer. Prefer checking before changing.

  • First diagnostic step

    A widespread or single-user symptom is described, and you choose between the Status Dashboard, audit logs and a targeted log search.

  • Trace the message

    Mail is missing, delayed or marked as spam, and you choose Email Log Search, header analysis or a routing review.

  • Recover and escalate

    Data was deleted or a fault persists, and you choose the admin restore or the logs to collect for Google Support.

Reasoning it through

Users across several offices report that Gmail is slow, starting fifteen minutes ago, and nothing was changed in the Admin console today. Before editing any settings, the administrator should check the Google Workspace Status Dashboard for a reported incident. If Google lists an issue, the right action is to communicate with users and follow the incident rather than troubleshooting local configuration that is not the cause.

Objectives 4

Official objectives from the Google Cloud outline, in outline order.

6.1 Identifying and diagnosing Workspace issuesAudit logs, log interpretation, Status Dashboard and mail policy changes.
What it means
This objective covers navigating audit logs in the Admin console, interpreting log entries, checking the Workspace Status Dashboard for service incidents, and recognising problems caused by recent changes to mail delivery policies.
What to understand
Audit logs record who did what and when, per service, including admin console changes, sign-ins and Drive actions. Filtering by user, event and time narrows an investigation quickly. The Status Dashboard shows Google-side incidents, so check it first when many users report the same symptom at once. Settings changes, especially Gmail routing and compliance rules, can take time to propagate, sometimes up to 24 hours, so a recent change is a likely cause of new mail behaviour.
How it shows up
A symptom appears after a change or affects many users, and you pick the log, dashboard or recent change to examine.
Common confusion
Assuming a settings change applies instantly; propagation delays can explain inconsistent behaviour.
6.2 Troubleshooting and resolving common issuesAccounts, mail delivery, headers, Calendar, Drive, recovery and Meet problems.
What it means
This objective covers resolving account, password, 2SV and service access problems, using Email Log Search, analysing headers and SPF, DKIM and DMARC with the Admin Toolbox, fixing forwarding, filter and label issues, Calendar sync with Apple and Outlook, Calendar sharing and free or busy, Drive sharing and permissions, Drive for desktop, recovering deleted Drive files and Gmail messages, Drive offline access, and Meet quality and access problems.
What to understand
Email Log Search traces messages sent or received in the last 30 days and shows their delivery status and routing. The Admin Toolbox Messageheader tool reads a pasted header and highlights delays and authentication results. Admins can restore Drive files and Gmail messages a user permanently deleted for about 25 days afterwards. Outlook users sync through Google Workspace Sync for Microsoft Outlook, while Apple Calendar uses CalDAV. The Meet quality tool shows network, device and call details for a meeting.
How it shows up
A user reports a missing email, deleted file, sync failure or poor call, and you choose the tool or fix.
Common confusion
Telling a user a permanently deleted file is gone when the admin restore window is still open.
6.3 Viewing, creating, and managing reports and audit logsApp usage, storage, audit reports and device activity.
What it means
This objective covers using reports to monitor app usage, storage against limits, audit activity and device activity, so that administrators can spot trends and problems before users raise tickets.
What to understand
Reports summarise activity across the organisation and per user, such as active users per app, storage consumed, and devices that have synced recently. Report data is processed with a delay, so it is better for trends than for live incidents, which belong in audit logs. Storage reports help find users or shared drives close to their limit. Device reports show inactive or non-compliant devices that may need attention.
How it shows up
A monitoring or capacity question is asked, and you choose the report or audit log that answers it.
Common confusion
Using reports for a live incident; report data lags, while audit logs are closer to real time.
6.4 Using support resourcesReproduction steps, log collection, HAR files, known issues and support cases.
What it means
This objective covers documenting how to reproduce a problem, collecting the right types of logs, checking app status and known issues, generating HAR files from the browser, opening a case with Google Support, and following the Workspace Updates blog, Status Dashboard and release calendar.
What to understand
Support cases are resolved faster with clear reproduction steps, affected users, timestamps and the right logs attached. A HAR file captures browser network traffic for web app issues. Desktop tools such as Drive for desktop and Google Workspace Sync for Microsoft Outlook have their own logs. Before opening a case, check the Status Dashboard and known issues. The Workspace Updates blog and release calendar explain new behaviour that users may report as a fault.
How it shows up
A problem needs escalation, and you choose what to collect or which resource to check first.
Common confusion
Opening a support case before checking whether a feature change was announced on the Workspace Updates blog.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Audit logs

    Per-service records of user and admin actions.

    Remember
    Filter by user, event and time.
    Tested as
    Who changed what questions.
    Trap
    Using usage reports to investigate a specific change.

  • Workspace Status Dashboard

    Google's public view of service incidents.

    Remember
    Check it first for widespread symptoms.
    Tested as
    Outage scenarios.
    Trap
    Changing settings during a Google incident.

  • Propagation delay

    Settings changes can take time to apply, up to 24 hours.

    Remember
    Recent changes explain inconsistent behaviour.
    Tested as
    After-change symptoms.
    Trap
    Reverting a change too early.

  • Email Log Search

    Traces messages from roughly the last 30 days with delivery details.

    Remember
    Search by sender, recipient, date or message ID.
    Tested as
    Missing mail tickets.
    Trap
    Searching older than its range.

  • Admin Toolbox Messageheader

    Analyses pasted message headers.

    Remember
    Shows hops, delays and SPF, DKIM and DMARC results.
    Tested as
    Spam and spoofing diagnosis.
    Trap
    Reading raw headers by hand under time pressure.

  • Drive and Gmail restore

    Admins can restore permanently deleted Drive files and Gmail messages for about 25 days.

    Remember
    Choose a date range and services.
    Tested as
    Recovery tickets.
    Trap
    Telling users data is unrecoverable too soon.

  • Deleted user restore

    Deleted accounts can be restored for about 20 days.

    Remember
    Different window from data restore.
    Tested as
    Account recovery.
    Trap
    Mixing up the 20 and 25 day windows.

  • Google Workspace Sync for Microsoft Outlook

    Syncs Outlook with Gmail, Calendar and Contacts.

    Remember
    Has its own logs for support.
    Tested as
    Outlook sync problems.
    Trap
    Troubleshooting it as an IMAP issue.

  • Meet quality tool

    Shows call details, participants, network and device data.

    Remember
    Use it for poor audio or video reports.
    Tested as
    Meet troubleshooting.
    Trap
    Changing Meet settings without checking call data.

  • Reports

    Aggregated usage, storage and device data.

    Remember
    Data is delayed; good for trends.
    Tested as
    Monitoring questions.
    Trap
    Using reports for real-time incidents.

  • HAR file

    A browser capture of network requests.

    Remember
    Collected for web app problems.
    Tested as
    Support escalation.
    Trap
    Sending screenshots instead of logs.

  • Workspace Updates blog and release calendar

    Announcements of feature changes and rollout timing.

    Remember
    Explain new behaviour users notice.
    Tested as
    Is it a bug or a change questions.
    Trap
    Opening a case for an announced change.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Audit logs vs. reports vs. Status Dashboard

ConceptMeaningKey differenceCommon trap
Audit logs Event-level records of actions Specific who, what, when Using them for long-term trends
Reports Aggregated usage and storage data Trends, delayed data Using them during a live incident
Status Dashboard Google-side incident status Service-wide problems Skipping it for widespread symptoms

Email Log Search vs. Messageheader

ConceptMeaningKey differenceCommon trap
Email Log Search Admin search of message delivery events Works when the message never arrived Searching beyond its time range
Messageheader Analyses headers of a received message Needs the message in hand Using it when the message is missing

Restore windows

ConceptMeaningKey differenceCommon trap
Deleted user Account restore available for about 20 days Restores the account Waiting too long after deletion
Drive files and Gmail messages Admin restore for about 25 days after permanent deletion Restores data for an existing user Assuming users' trash is the only option

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Fix settings during an outage

    What candidates pick
    Revert recent mail settings because many users report slow Gmail.
    Why it looks right
    A recent change feels like the obvious cause.
    Why it's wrong
    If Google reports an incident, local changes add risk without helping; check the Status Dashboard first.

    Clue to watch for Many users across locations are affected at once.

  2. Header for missing mail

    What candidates pick
    Ask the user to forward the message headers for an email that never arrived.
    Why it looks right
    Headers are the standard mail diagnostic.
    Why it's wrong
    There is no header without a received message; Email Log Search traces delivery.

    Clue to watch for The recipient never got the email.

  3. File gone forever

    What candidates pick
    Tell a user their file was emptied from trash and cannot be recovered.
    Why it looks right
    The user deleted it permanently.
    Why it's wrong
    Admins can restore Drive files for about 25 days after permanent deletion.

    Clue to watch for The deletion happened within the last few weeks.

  4. Reports for live events

    What candidates pick
    Use the apps usage report to see who shared a file an hour ago.
    Why it looks right
    Reports show Drive activity.
    Why it's wrong
    Report data is delayed and aggregated; Drive audit logs show the event.

    Clue to watch for A specific recent action must be found.

  5. Case without evidence

    What candidates pick
    Open a support case describing the problem in one sentence.
    Why it looks right
    Support should investigate.
    Why it's wrong
    Cases need reproduction steps, timestamps and logs such as HAR files to be resolved quickly.

    Clue to watch for The question asks how to speed up resolution.

  6. Instant effect

    What candidates pick
    Assume a routing rule failed because mail still behaves the old way ten minutes later.
    Why it looks right
    Admin console changes look immediate.
    Why it's wrong
    Changes can take up to 24 hours to propagate fully.

    Clue to watch for The change was made very recently.

Answer framework

Use these steps to work through any Section 6 troubleshooting scenario in a sensible order.

  1. Establish scope and timing: one user or many, since when, and whether anything changed recently in the Admin console.
  2. For widespread symptoms, check the Workspace Status Dashboard and known issues before touching configuration.
  3. Gather evidence with the right tool: audit logs for actions, Email Log Search for missing mail, Messageheader for received mail, and the Meet quality tool for calls.
  4. Fix or recover within the limits of each tool, such as restoring Drive or Gmail data within about 25 days, and allow time for settings to propagate.
  5. If the fault remains, collect HAR files and client logs with reproduction steps and timestamps, check the Workspace Updates blog, and open a support case.

Practice question

A customer says she sent an important email to a sales manager yesterday, but the manager cannot find it in any folder, including spam. Other mail is arriving normally. What should the administrator do first to find out what happened to the message?

Want more like this? The Workspace Admin practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Build this section around tools rather than symptoms. List each diagnostic tool, including audit logs, the Status Dashboard, Email Log Search, the Admin Toolbox Messageheader, the Meet quality tool, reports and the data restore option, and write one line on what question it answers and what it cannot see. In a test tenant, send a message, find it in Email Log Search, paste its header into the Admin Toolbox, then delete a file permanently and restore it from the Admin console.

Next, work through common tickets one at a time: a forgotten password with 2SV, an Outlook calendar that stopped syncing, a Drive file a user cannot open, a Meet call with poor video. For each, write the first step and the evidence you would collect. Learn the key time windows, such as about 30 days for Email Log Search, about 25 days for data restore and about 20 days for deleted users. Finally, practise writing a short support case with reproduction steps and the logs Google would expect.

FAQ

How much of the Workspace Admin exam is Section 6?

Monitoring and troubleshooting common issues is about 13% of the exam, around 7 questions.

What should I check first when many users report the same problem?

Check the Google Workspace Status Dashboard for a reported incident, and review any recent Admin console changes, before changing settings.

How far back does Email Log Search go?

It covers roughly the last 30 days of messages. For older mail, use Vault if the data is retained.

Can an admin recover a file a user deleted from trash?

Yes. Admins can restore Drive files and Gmail messages for about 25 days after they were permanently deleted.

What is a HAR file and when is it needed?

A HAR file records the browser's network activity. Google Support asks for it when a web-based Workspace app behaves incorrectly.

Why are reports not useful for a live incident?

Report data is processed with a delay and aggregated. Audit logs and Email Log Search give event-level detail closer to real time.

Where can I learn about feature changes users notice?

The Workspace Updates blog and the release calendar announce new features and rollout timing.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered audit logs, the Status Dashboard, mail tracing, data recovery, reports and support resources. Test whether you can choose the right first step.

Take the Workspace Admin practice test Check your Workspace Admin readiness

Keep going