Troubleshooting
Behavior Profile Build Fails
The built-in behavior profile runs the google-workspace-users command without the profile option, so if there are multiple Google Workspace connect profiles, it runs with all of them. If any of them lacks user lookup permissions or does not work, the build fails. For the required permissions, see the users row in 1. Required Permissions.
- Identify the failed connect profile from the error message.
- Add the required permissions to that connect profile, or delete it if it is not used.
- To use only a specific connect profile, create a new behavior profile with the same query and specify
profile=<identifier>in the query, because built-in behavior profiles cannot be modified.
Actions by Error Message
Starting with 1.9.2610.0, when permissions are insufficient, the query command results and logger status show the required action.
| Message | Cause | Action |
|---|---|---|
register OAuth scopes in domain-wide delegation: ... | Scope not registered in domain-wide delegation | Add the shown scopes to domain-wide delegation |
OAuth user credential must include scopes: ... | Scope missing from the refresh token | Issue the refresh token again including the shown scopes |
account has no admin privilege for this API | The delegated or consenting account has no admin privilege | Add the required privilege to the admin role |
share the spreadsheet with the account | Spreadsheet not shared with the account | Share the spreadsheet with the delegated or consenting account |
enable the API in the Google Cloud project | API not enabled in Google Cloud | Enable the API |
alert center requires service account key ... | Alert Center used with the OAuth method | Assign a service account profile to the Alert Center logger |
delegated user is required for service account key | Service account method without a delegated user | Enter Delegated User in the connect profile |
group not found: ... | The group in the group option was not found | Enter the group name, not the group email |
Loggers Stopped After an Upgrade
Upgrading to 1.9.2610.0 or later while loggers are running may stop them with an error. Disable the Google Workspace loggers and enable them again. Loggers resume from the last collection point, so no logs are lost.
Permission Changes Not Applied
After changing scopes or privileges in the Admin console, save the connect profile once. The app reuses the token it received for up to 1 hour, so changes may not apply immediately unless you save.
Reducing OAuth Scopes
With the user account OAuth method, consenting again with different scopes does not invalidate previously issued refresh tokens; they keep the old scopes. To reduce scopes, revoke the existing consent first.
- Sign in with the dedicated integration account, go to Google Account > Security > Third-party apps & services, and remove access for the app registered on the OAuth consent screen (e.g., Logpresso Sonar). All refresh tokens issued for this app become invalid.
- Repeat Step 3 of 3-2. User Account OAuth with the reduced scopes, and check that the
scopein the response contains only the scopes you need. - Replace the Service key of the connect profile with the new refresh token and save.
When the cause is hard to find
Use the Permission Check Script to call the Google APIs with the same settings as the Sonar connect profile and see which features are available and what to do. Sending the result file to Logpresso technical support helps the analysis.