(1) Is the guest generating disk and network activity (a.k.a are the lights flashing)?
I don’t have nice code for this, but you can see the technique that Oz uses here. Oz uses the libvirt monitoring APIs to look for disk and network activity, and signals when it hasn’t seen any after a certain timeout period.
(2) When was the last time a user logged in?
(3) What was the last file updated in a guest?
Finally, if you’re interested in the newest file updated in a guest, see this technique which will work for any Linux or Windows guest.
Are there other kinds of “activity” that it’s interesting to find from guests?