Yes, 6005 event occurs when EventLog service was started and 6006 - when EventLog was stopped, which commonly means system startup and shutdown. But 6006 occurs on normal shutdown only, you should also check for event 6008 which means that the system shutdown was unexpected.