Anomaly-based retention policies for snapshot-based data protection systems

A system, comprising:

• one or more hardware processors;
• and
• a computer readable storage medium having stored therein instructions that are executable by the one or more hardware processors to perform operations comprising:
• monitoring performance of an element of a runtime environment, and monitoring comprises collecting performance information concerning the element;
• analyzing the collected information;
• detecting, based on the analysis of the collected information, an anomaly in the performance of the element;
• and
• in response to detection of the anomaly, automatically marking a snapshot of the runtime environment element, and the marking of the snapshot overrides a retention policy applicable to the snapshot.