- In Vault, go to Reports > Audit.
- In Select date range, include start and end dates for the audit.
- In Select Vault users, include users on whom you want to run the audit. The Vault users you enter here have Vault privileges; you are auditing their actions in Vault (for example, if they've set retention rules, searched in matters, modified holds, or performed any other administrative actions).
- In Select action types, check the boxes next to actions about which you want audit information.
- Click Download CSV. A CSV file that contains audit information will be downloaded to your device.
https://support.google.com/vault/answer/4239060?hl=en