The easiest way to get notified in real-time whenever specific service/driver starts or stops is by forwarding “EventSentry” event 10100 or 10150. This particular event is logged by EventSentry when a service or drivers status changes.
Service monitor is a feature that is enabled by default in EventSentry under "System Health ->Services" and will monitor all automatic services/drivers except for those listed. If this package isn't assigned or doesn't exist, then these events will not be created.
Event Log: Application Severity: Information Source: EventSentry Category: Service Monitoring Event ID: 10100,10150 Content Filter: *Service Name*