What you want is to be able to alert on a scenario... when event 6009 (Microsoft (R) Windows (R) processor free) + 6005 (event log start) occurs and eventlog 6006 can not be found prior.
(Event 6006 is logged when the event log service is shut down properly before system shutdown.)
I´m not sure if this can be set up though. I guess you would have to build your own procedure to accomplish something like that.
I've never heard of event id 6008 NOT logging when an unexpected shutdown occurs though.
We monitor event 6008 in computers for unexpected reboots.