Troubleshooting
Actions by Error Message
Starting with 1.9.2610.0, when permissions are insufficient, the query command results and collector status show the required action.
| Message | Cause | Action |
|---|---|---|
register OAuth scopes in domain-wide delegation: ... | Scope not registered in domain-wide delegation | Add the shown scopes to domain-wide delegation |
OAuth user credential must include scopes: ... | Scope missing from the refresh token | Issue the refresh token again including the shown scopes |
account has no admin privilege for this API | The delegated or consenting account has no admin privilege | Add the required privilege to the admin role |
share the spreadsheet with the account | Spreadsheet not shared with the account | Share the spreadsheet with the delegated or consenting account |
enable the API in the Google Cloud project | API not enabled in Google Cloud | Enable the API |
alert center requires service account key ... | Alert Center used with the OAuth method | Assign a service account profile to the Alert Center collector |
delegated user is required for service account key | Service account method without a delegated user | Enter Delegated User in the connect profile |
group not found: ... | The group in the group option was not found | Enter the group name, not the group email |
Collectors Stopped After an Upgrade
Upgrading to 1.9.2610.0 or later while collectors are running may stop them with an error. Disable the Google Workspace collectors and enable them again. Collectors resume from the last collection point, so no logs are lost.
Permission Changes Not Applied
After changing scopes or privileges in the Admin console, save the connect profile once. The app reuses the token it received for up to 1 hour, so changes may not apply immediately unless you save.
Reducing OAuth Scopes
With the user account OAuth method, consenting again with different scopes does not invalidate previously issued refresh tokens; they keep the old scopes. To reduce scopes, revoke the existing consent first.
- Sign in with the dedicated integration account, go to Google Account > Security > Third-party apps & services, and remove access for the app registered on the OAuth consent screen (e.g., Logpresso Sonar). All refresh tokens issued for this app become invalid.
- Repeat Step 3 of 3-2. User Account OAuth with the reduced scopes, and check that the
scopein the response contains only the scopes you need. - Replace the Service key of the connect profile with the new refresh token and save.