01Fields in the event
The cited Microsoft page does not list field names for this event.
02How to use it
Read it with 1102: a cleared Security log is recorded as 1102, and the Windows Event Forwarding page lists 104 in the System log as "Other Log cleared events". For either, treat the entry as the start of a gap and look for earlier events in forwarded copies (SIEM, Windows Event Forwarding), Volume Shadow Copies or unallocated space. Which log was cleared, and by whom, is not documented on the cited page; read it from the record in the Event Viewer of the system under examination.
03Read it with
- 1102 The audit log was clearedThe Windows Event Forwarding page lists them side by side: 1102 for the clearing of the Security log and, in the System log, 104 as "Other Log cleared events". Check both when you ask whether logs were cleared. Only 1102 is documented with named fields; any details of a 104 have to be read from the record itself.
04Caveats
The cited page does not document field names; read the details in the record from the Event Viewer of the system under examination. It mentions this ID only in a forwarding query and does not describe the provider or which logs the event covers, so a missing 104 does not show that no log was cleared.