Virtual machine introspection

Virtual machine introspection (VMI) is a technique for externally monitoring the runtime state of a system-level virtual machine.

VMI tools are typically located outside the virtual machine (e.g., in the virtual machine monitor) and act by tracking the events (interrupts, memory writes, and so on) or sending the requests to the virtual machine. Virtual machine monitor usually provides low-level information like raw bytes of the memory. Converting this low-level view into something meaningful for the user is known as the semantic gap problem.