Technical Tip: Identifying and differentiating the logs for Google Drive and Google Drive file upload

[ekrishnan]

Description	This article explains the difference between Google Drive and Google Drive file upload logs.
Scope	FortiGate.
Solution	When a file is uploaded to Google Drive, the application name will be shown as 'google.drive_upload' along with file name, whereas just accessing the Google Drive without any upload will only show as 'google drive'. When there is a file upload, an extra field of the  'filename' and the cloudaction will be visible. Example: date=2025-06-19 time=01:07:14 eventtime=1750320433664444579 tz="-0700" logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" vd="root" appid=32122 srcip=10.103.0.2 srccountry="Reserved" dstip=216.58.199.238 dstcountry="United States" srcport=51095 dstport=443 srcintf="port3" srcintfrole="undefined" dstintf="port1" dstintfrole="undefined" proto=6 service="HTTPS" direction="outgoing" policyid=1 poluuid="beaaa60e-4339-51f0-9f34-d4b957a287a5" policytype="policy" sessionid=395325 applist="Test" action="pass" appcat="Storage.Backup" app="Google.Drive_File.Upload" hostname="clients6.google.com" incidentserialno=34606800 url="/upload/drive/v2internal/batch?key=AIzaSyD_InbmSFufIEps5UAt2NmB_3LvBH3Sz_8" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" httpmethod="PUT" referralurl="https://drive.google.com/" msg="Storage.Backup: Google.Drive_File.Upload" clouduser="xyz@gmail.com" filename="images.jfif" apprisk="medium" cloudaction="upload"