Systems, methods, and computer program products to perform an operation comprising storing, by a kernel and in a queue, an indication that a first process has called a second process, collecting process data for at least one of the first process and the second process, determining, by the kernel, that an amount of time that has elapsed since the first process called the second process exceeds a time threshold, storing the queue and the process data as part of a failure data capture, and performing a predefined operation on at least one of the first process and the second process.