1. A method of determining a status of a virtual machine (VM) running in conjunction with a virtual machine monitor (VMM), wherein one or more applications and a guest operating system (OS) are running in the VM, the method comprising: collecting a stream of events from the VMM, each event in the stream corresponding to an operation of the VMM; and determining the status of the VM as a function of the collected stream of events.