Review: Troubleshooting

Section 6 of the guide, about 13 in every 100 questions, is about keeping people working when something goes wrong. Its four objectives cover identifying and diagnosing problems, resolving common issues, using reports and audit logs, and using support resources. Troubleshooting questions also appear inside other sections, wherever a scenario begins with "a user reports that...", so the method in this lesson earns marks well beyond section 6.

Owen did a lot of troubleshooting in GCP-211 and GCP-212, but almost all of it was mail and access during Birchline's pilot. The exam ranges wider: calendars, Drive for desktop, Meet quality, recovery of deleted data, reports and support cases. Sofia starts with a method that works across all of them.

A troubleshooting order

The first two steps are the ones the exam tests hardest, because they decide what to do first. When many users across the organization report the same problem at once, the Status Dashboard is a sensible first check. When one user or one place is affected, the cause is almost always local: a setting, a license, a device or a network. Changing settings before establishing scope is the most common wrong answer.

6.1 Identifying and diagnosing

The guide lists finding audit logs in the Admin console, interpreting log entries, checking the Status Dashboard, and recommending fixes for mail delivery. GCP-212 covered the logs. In exam terms: logs are under Reporting in the Admin console, organized by service; they can be filtered by user, event, date and many other attributes; Google documents most log events as available for six months, with a lag from minutes to hours depending on the log; and for longer retention, logs can be exported to BigQuery on editions that support it. An entry shows who did what, to what, when and from where, which is often enough to answer a question on its own.

6.2 Resolving common issues

This objective has the longest list in the section. Owen groups it by service.

Deleted data is a favorite topic, and the timings are worth knowing in outline while checking the current numbers in the documentation. Files a user deletes go to Drive trash, where they stay for about 30 days before being removed. After that, an administrator can restore Drive files and Gmail messages for a further period, which Google's help pages have described as 25 days. After both windows, only Vault can produce data, and only if a retention rule or hold covered it. Owen writes the chain as user trash, then admin restore, then Vault.

Message headers return from GCP-212. A header shows every server a message passed through, with times, and the authentication results for SPF, DKIM and DMARC. The Messageheader tool in the Admin Toolbox makes headers readable and shows where delays occurred. Check MX checks a domain's DNS records for mail. Email Log Search in the Admin console finds a message by sender, recipient, date or message ID and shows what happened to it: delivered, marked as spam, quarantined, rejected, routed elsewhere.

Account and 2SV lockouts

Sign-in problems are the most common calls to any help desk, and the exam reflects that. Owen reviews the safe sequence for a user locked out by 2-step verification. First, verify the person's identity through a channel the organization trusts, such as a call back to a known number or a manager's confirmation; never act on an email from the account itself, because an attacker may control it. Second, check the login audit log for what happened: a lost phone, a new device, a blocked sign-in from an unusual place. Third, choose the smallest fix: generate backup verification codes for the user, or temporarily allow sign-in without 2SV for a short time if policy permits, and make sure 2SV is set up again straight away. If the account shows signs of compromise, the response is the incident sequence from GCP-212 instead: suspend, revoke sessions and app tokens, reset the password and investigate.

Calendar problems have their own patterns. A user who cannot see a colleague's free and busy times may be blocked by the internal sharing default, by the colleague's own sharing choice, or, during coexistence with another calendar system, by interoperability settings. A meeting room that will not accept a booking may be restricted by the resource's sharing, may require approval, or may have a booking rule such as a maximum duration. As always, scope first: if no one can see anyone's free and busy times, the cause is an organization or interop setting; if one person cannot, it is something about that person or calendar.

6.3 Reports and audit logs

The guide also asks candidates to monitor app usage, storage, devices and audit reports. Reports in the Admin console show adoption and usage by app, storage use by user and in total, device activity, and security metrics. Exam questions in this objective are usually about choosing the report: "Which users are close to their storage limit?" points to user reports with storage columns; "Is Meet adoption growing in the stores?" points to app usage reports filtered by OU; "Which devices have not synced in 30 days?" points to the devices list and device reports.

Reports are not real time. Like the logs, they have lag, and some report data is updated daily. A question that asks why yesterday's change is not yet visible in a usage report is usually about that lag, not about an error.

6.4 Using support resources

When a problem cannot be fixed with the tools above, the administrator escalates to Google support. The guide lists documenting steps to reproduce, collecting logs, checking app status and known issues, generating HAR files, opening cases, and using the Workspace Updates blog, the Status Dashboard and the release calendar.

A good support case is specific. Sofia's template, which Birchline uses: who is affected, how many, since when; exact steps to reproduce; expected and actual results; times in a stated time zone; screenshots or error text; log entries; a HAR file if the problem is in the browser; and what has already been tried. Owen notices that the template is the troubleshooting order written down. A case that skips scope and evidence gets the same questions back from support, and days are lost.

The release calendar matters for one more reason. Features reach organizations on the Rapid Release track before those on the Scheduled Release track. A question that says one administrator sees a new option and another does not may be answered by their release tracks, not by a fault.

Owen's unsure list for section 6

• The current windows for admin restore of Drive files and Gmail messages after the trash is emptied.
• How Calendar interoperability with Exchange is diagnosed, and what its troubleshooting tool checks.
• How to generate a HAR file in Chrome and what to remove from it before sending, because it can contain sensitive data.
• Which reports update daily rather than within hours.
• What the Meet quality tool shows about a past meeting and for how long.