diff --git a/include/perfmon/pfmlib_perf_event.h b/include/perfmon/pfmlib_perf_event.h
index 8b3dae2..1397ee0 100644
--- a/include/perfmon/pfmlib_perf_event.h
+++ b/include/perfmon/pfmlib_perf_event.h
@@ -29,6 +29,8 @@
 extern "C" {
 #endif
 
+#define PERF_PROC_FILE "/proc/sys/kernel/perf_event_paranoid"
+
 /*
  * use with PFM_OS_PERF, PFM_OS_PERF_EXT for pfm_get_os_event_encoding()
  */
diff --git a/lib/pfmlib_perf_event.c b/lib/pfmlib_perf_event.c
index 8618d60..b7e8fc5 100644
--- a/lib/pfmlib_perf_event.c
+++ b/lib/pfmlib_perf_event.c
@@ -246,7 +246,9 @@ pfmlib_perf_event_encode(void *this, const char *str, int dfl_plm, void *data)
 	attr->exclude_user   = !(plm & PFM_PLM3);
 	attr->exclude_kernel = !(plm & PFM_PLM0);
 	attr->exclude_hv     = !(plm & PFM_PLMH);
+#if 0
 	attr->exclude_guest  = !(vmx_plm & PFM_PLM3);
+#endif
 	attr->exclude_host   = !(vmx_plm & PFM_PLM0);
 	attr->pinned	     = pinned;
 
diff --git a/perf_examples/perf_util.c b/perf_examples/perf_util.c
index 0b34ed5..6f89414 100644
--- a/perf_examples/perf_util.c
+++ b/perf_examples/perf_util.c
@@ -58,6 +58,16 @@ perf_setup_argv_events(const char **argv, perf_event_desc_t **fds, int *num_fds)
 	}
 	group_leader = num;
 
+	FILE *f;
+	char *suffix = NULL;
+	char event[1024] = "";
+	int paranoid = -1;
+
+	if ((f=fopen(PERF_PROC_FILE,"r")) && (fscanf(f,"%d",&paranoid) == 1) && (paranoid == 2)) {
+	    warnx("%s level 2 means user events only! Ensuring :u on event string.",PERF_PROC_FILE);
+	    suffix = ":u";
+	  }
+
 	while(*argv) {
 		if (num == max_fds) {
 			if (max_fds == 0)
@@ -88,13 +98,16 @@ perf_setup_argv_events(const char **argv, perf_event_desc_t **fds, int *num_fds)
 		arg.attr = &fd[num].hw;
 		arg.fstr = &fd[num].fstr; /* fd[].fstr is NULL */
 
-		ret = pfm_get_os_event_encoding(*argv, PFM_PLM0|PFM_PLM3, PFM_OS_PERF_EVENT_EXT, &arg);
+		strcpy(event,*argv);
+		if (suffix && (strstr(event,suffix) == NULL)) strcat(event,suffix);
+
+		ret = pfm_get_os_event_encoding(event, PFM_PLM0|PFM_PLM3, PFM_OS_PERF_EVENT_EXT, &arg);
 		if (ret != PFM_SUCCESS) {
-			warnx("event %s: %s", *argv, pfm_strerror(ret));
+			warnx("event %s: %s", event, pfm_strerror(ret));
 			goto error;
 		}
 
-		fd[num].name = strdup(*argv);
+		fd[num].name = strdup(event);
 		fd[num].group_leader = group_leader;
 		fd[num].idx = arg.idx;
 		fd[num].cpu = arg.cpu;