create a snapshot of instances before running audits