The following logging tracks logins and activity by ServiceNow employees.

Event Logs The event logs show all ServiceNow logins to a customer instance.
Transaction logs The transaction logs show all activity on the instance, including any efforts to delete logs.