A method includes receiving a signal indicative of a value of a data point associated with a compute device at a first time. The value of the data point includes a data point category that is correlated with a fault category. The compute device is operatively coupled to a record module having a protected mode and an unprotected mode. A signal is received indicative of a value of the data point at a second time, after the first time. When a characteristic of a change in the value of the data point at the first time to value of the data point at the second time crosses a threshold in a first direction, a signal is sent to the record module indicative of an instruction to record data associated with the compute device in the protected mode to define a protected data set.