is this not in now??
but not checking event log, the monitor checks the service itself.
so as soon as the service stops, the rule fires and starts a task, within that task can be a batch job that starts the service. i have tested this just now and works just fine, wouldnt have looked at this till i saw your post though so thanks!