A method and an apparatus for generating a virtual machine snapshot, where the method includes suspending a virtual machine according to a received snapshot command, enabling write protection on a memory page of the virtual machine in a user mode, wherein the write protection causes the memory page to be blocked in a kernel mode and a write protection exception to be processed in the user mode, storing the memory page to a snapshot file before the memory page is contaminated, restoring the virtual machine after the storage is completed.