Logging audit logs stopping without a reboot

I need to create a report that logs events where the audit logs stopped reporting that are not caused by a reboot.  There are about three different events names where the audit logs stop and the same with reboots.   The reboot and the logs are at the same second on the end time and the same DomainHostName.  What can I do to find times when the audit logs have stopped not associated with a reboot? 

I have a active channel that shows the logs have stopped reporting and reboots, and it looks like there is no incident where the logs have stopped without a reboot. 

I have created a rule that identifies reboots and puts the domain on an active list and have the not in the active list.  added to the rule, fired when there there was a reboot associated with it confirmed by looking at the active channel.  I think it was a race condition.  We have even tried to use the wait action.

I have thought of using two events one being the audit logs stopping and the other being the reboots and the reboots events being negated with a match event time of 5 seconds.  just looking for a sanity check and see if someone can point me in the right direction.  Thanks.