If you decide that getting the information from the event log is the way to go, take a look at Win32::EventLog. That'll let you extract the contents of the Security log, at which point you can apply good old Perl to parse the results. Logon and logoff events have different IDs, so it shouldn't be too tough to determine how long a user was logged in to a certain node.

Guildenstern
Negaterd character class uber alles!