Hi, Uncheck automatically resolve alerts. Keep in mind that means you will get new alert every time event stopped is logged for the service. In general automatically resolve alerts feature is stateful/stateless alert. Alert should be stateful if the log sends data on certain frequency. Most notably these are performance metrics. Configuration changes for windows services are like event based records. Records are send only when certain thing happens rather on frequency. For event based logs it should be stateless (automatically resolve alerts off).
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.