Responding to an event at a server that supports workload partitions. An event is detected. The event is an activity that can degrade an ability of the server to function according to an intended purpose. The event is triggered by a communication from a client to the server. Responsive to detecting the event, a connection of the client to the server is temporarily suspended. A first workload partition is created. The connection is re-established between the client and the server. Responsive to re-establishing the connection, all data is routed from the client to the first workload partition. In an illustrative example, the event is allowed to continue on the first workload partition while forensic data is collected on the event.