A method monitors machine activity of multiple virtual computing devices operating through at least one physical computing device by running a monitoring agent. The monitoring agent monitors performance of the multiple virtual computing devices. The method measures simple operating characteristics of only a base level virtual computing device. The method monitors complex operating characteristics using the monitoring agent by: measuring the complex operating characteristics for each of the multiple virtual computing devices (using each of the multiple virtual computing devices); recording the complex operating characteristics of each of the multiple virtual computing devices on a corresponding memory page of each of the multiple virtual computing devices; and sharing each the corresponding memory page with the base level virtual computing device through an interdomain communications channels to transfer the complex operating characteristics to the monitoring agent. The method identifies simple events and complex events for each of the multiple virtual computing devices by evaluating the simple operating characteristics and the complex operating characteristics and outputs the simple events and the complex events for each of the multiple virtual computing devices.