1. A method performed by a computing device having a processor, the method comprising: receiving, with the processor, an indication to start collecting auditing information from an auditing information source having one or more protected virtual machines from outside of the one or more protected virtual machines, wherein the auditing information includes one or more events of user actions on the one or more protected virtual machines and corresponding users associated with the one or more events; receiving the auditing information from the identified auditing information source during operation of the one or more protected virtual machines; storing the received auditing information in a log location outside of the one or more protected virtual machines along with identifying information of the auditing information source; and protecting the received and stored auditing information from modification by one or more users having an account on the one or more protected virtual machines regardless of privilege levels of the one or more users with respect to the one or more protected virtual machines.