Event and process ID in NT 4.0

Help, I have an internal security problem and am in need of a key listing of the event and process ID’s reported in NT 4.0 event viewer. I recently had the application log cleared on our exchange server, Obviously by someone holding admin Rights.This is also Obviously a cover up of privliaged use activity on an Exchange 5.5 server. Is the clearing of the event logs recorded/tracked if auditing is set to log process tracking?

Where may I find a key to the process and event ID’s reported in event viewer?? Technet does not have it…
Thanks!