Determining a time for on-demand snapshotting of a virtual machine in a node prior to a failure point in a system comprising a plurality of nodes. Failure data is collected from a set of failed nodes of the plurality of nodes in a system. A failure pattern of the node is identified based on the failure data and monitoring the plurality of nodes for the failure pattern to determine that a first node of the plurality of nodes is exhibiting the failure pattern. Responsive to the determination that the first node is exhibiting the failure pattern, capturing a snapshot of a virtual machine corresponding to the first node.