Essentials: SLES 11 SP3 x86_64 running Xen Hypervisor and SLE 11 SP3 HAE

I have a customer who is looking to audit certain activity. He wants to know when someone tries to create a Xen guest. I'm assuming that there is activity either in the syslog or somewhere else, and I'm looking for a little guidance to expedite my search. Do you have any suggestions that might help me? Thanks!