Macko, PeterChiarini, Marc A.Seltzer, Margo2011-10-072011Macko, Peter, Marc Chiarini, and Margo Seltzer. Forthcoming. Collecting provenance via the Xen hypervisor. In Proceedings of 3rd USENIX Workshop on the Theory and Practice of Provenance (TaPP '11), June 20-21, 2011, Heraklion, Crete, Greece. Berkeley, CA: USENIX Association.http://nrs.harvard.edu/urn-3:HUL.InstRepos:5168855The Provenance Aware Storage Systems project (PASS) currently collects system-level provenance by intercepting system calls in the Linux kernel and storing the provenance in a stackable filesystem. While this approach is reasonably efficient, it suffers from two significant drawbacks: each new revision of the kernel requires reintegration of PASS changes, the stability of which must be continually tested; also, the use of a stackable filesystem makes it difficult to collect provenance on root volumes, especially during early boot. In this paper we describe an approach to collecting system-level provenance from virtual guest machines running under the Xen hypervisor. We make the case that our approach alleviates the aforementioned difficulties and promotes adoption of provenance collection within cloud computing platforms.en-USMonograph or Book2011-10-07