One example method includes monitoring performance of an element of a runtime environment, where the monitoring includes collecting performance information concerning the element, analyzing the collected information, detecting, based on the analysis of the collected information, an anomaly in the performance of the element and, in response to detection of the anomaly, automatically marking a snapshot of the runtime environment element, and the marking of the snapshot overrides a retention policy applicable to the snapshot.