Event 1102 is logged to the security event log when the security event log is cleared.  This event differs from most events in the security event log in that the event source is “Microsoft-Windows-Eventlog”, not “Microsoft-Windows-Security-Auditing”.

By default, this event will be collected, but the event parameters will be stored in string fields 1-4.  If you want to store these parameters in another location, you need to specify an event transform in EventSchema.xml.  I’ve provided an example below that puts the parameters into the PrimarySid, PrimaryUser, PrimaryDomain, and PrimaryLogonId.  You need to add this section to your existing EventSchema.xml at the same level as the other Sources.

<Source Name="Microsoft-Windows-Eventlog">
  <Version MinBuild="5384" MaxBuild="9999" UniqueId="FC65DDD8-D6EF-4962-83D5-6E5CFE9CE148">
      <String Entry="-" />
      <String Entry="0x0" />
    <Event SourceId="1102" SourceName="SE_AUDITID_AUDIT_ETW_LOG_CLEARED">
      <Call Name="AppendString" Param1="1" Param2="0" />
      <Call Name="AppendString" Param1="2" Param2="0" />
      <Call Name="AppendString" Param1="3" Param2="0" />
      <Call Name="AppendString" Param1="4" Param2="0" />
      <Param TypeName="typePrimarySid" />
      <Param TypeName="typePrimaryUser" />
      <Param TypeName="typePrimaryDomain" />
      <Param TypeName="typePrimaryLogonId" />