why only tracking selected events?  

feels like we should get CREATING/STARTING and STOPPING at least.  or if that's too much work open an issue and put comments in the code.  or if there's a good reason, an explanation.

and why this particular pair?

i'd expect either to be charged from when the app/vm starts CREATING to when it is finally DESTROYED, *or* from when the app/vm is RUNNING to when it starts STOPPING, if i'm of the view that start/stop times are consumed by the provider.  going from RUNNING to DESTROYED is odd (i don't want to be charged in a cloud with a long shutdown time, that's their own fault!!!).