If you were running Windows NT, 2000, XP or 2003, you could use Win32::EventLog.

use Win32::EventLog;

$Win32::EventLog::GetMessageText = 1;

my $eventlog = Win32::EventLog->new('System', $ENV{ComputerName}) or d
+ie "Can't open System EventLog\n";

my %event;
        
while ($eventlog->Read(EVENTLOG_BACKWARDS_READ| EVENTLOG_SEQUENTIAL_RE
+AD, 0, \%event)) {
  if ( $event{EventType} == EVENTLOG_INFORMATION_TYPE && $event{Source
+} eq 'Tcpip' ) {
    print $event{RecordNumber}, ' ', scalar localtime($event{TimeGener
+ated}), ' ', $event{Message}, "\n";
    last; # this example only shows the last
  }
}
[download]

I unplugged my network cable and ran it. X:\Code>eventlog.pl 4368 Wed Feb 2 21:11:23 2005 The system detected that network adapter \DEVICE\T CPIP_{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers.

I plugged my network cable back in and ran it again. X:\Code>eventlog.pl 4369 Wed Feb 2 21:11:38 2005 The system detected that network adapter \DEVICE\T CPIP_{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} was connected to the network, and has initiated normal operation over the network adapter.

See also: Roth Consulting's EventLog.pl script.