NPM tracks this information for you, and you can display it on the front page or NOC view of NPM by adding the "Last XX Audit Events" resource there.
You can edit the resource to show as many Events, over as many Days, as you'd like. There are MANY audit events that can be displayed there. Just select all the ones that interest you and add the Resource to your NPM front page view. Or set up NPM to automatically mail it to you as a report every month.
Thanks. I do understand that. I guess I was looking for what kind of event is generated if the syslog daemon is stopped. I don't work on our routers so I just wanted to ask our Netops guy to do the correct process to generate an audit event of "syslog was stopped" and "syslog was started".