Collecting provenance via the Xen hypervisor