Contributed By: Baelson Duque [MSFT]
Some services are configured to automatically attempt to restart the service automatically. Check the EventLog, you should see both the stop event and the start event. It's just that by the time you check the server, the service has already started.

What you can do to minimize the alerts you are seeing, would be to create a consolidation rule to only alert you when you've got X amount of those events the last Y hours. You can also check if the service is configure to restart (so you can proactively create the rules) by looking at it's properties in the Computer Management MMC or use sc.exe from the Windows 2000 reskit:

C:\Documents and Settings\baelsond
$ > sc Error! Hyperlink reference not valid. qfailure iisadmin
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: iisadmin
        RESET_PERIOD (in seconds)    : 86400
        REBOOT_MESSAGE               :
        COMMAND_LINE                 : "C:\WINNT\system32\iisreset.exe"
/start /fail=%1%
        FAILURE_ACTIONS              : RUN PROCESS -- Delay = 1
milliseconds.
                                       RUN PROCESS -- Delay = 1 milliseconds.
                                       RUN PROCESS -- Delay = 1 milliseconds.