A computer-implemented method for managing the execution of a virtual machine, comprising: taking a series of snapshots (202, 204, 206) of the virtual machine during execution of the virtual machine; if an abnormal operation of the virtual machine is detected: selecting, from the series of snapshots, a snapshot taken prior to the detection of the abnormal operation to execute as a set of snapshot instances; spawning the set of snapshot instances (210, 212) from the selected snapshot; concurrently executing snapshot instances from the set of snapshot instances, each of the set of snapshot instances including a respective set of limitations, wherein each limitation blocks a different potential source of the abnormal operation, such that a snapshot instance executed with a given limitation does not process incoming events from the potential source of the abnormal operation which is blocked by that limitation; determining a source of the abnormal operation using a snapshot instance from the set of snapshot instances that does not exhibit the abnormal operation because it includes a limitation that blocks the source of the abnormal operation; and updating a state of the virtual machine using the snapshot instance that includes the limitation that blocks the source of the abnormal operation. taking a series of snapshots (202, 204, 206) of the virtual machine during execution of the virtual machine; if an abnormal operation of the virtual machine is detected: selecting, from the series of snapshots, a snapshot taken prior to the detection of the abnormal operation to execute as a set of snapshot instances; spawning the set of snapshot instances (210, 212) from the selected snapshot; concurrently executing snapshot instances from the set of snapshot instances, each of the set of snapshot instances including a respective set of limitations, wherein each limitation blocks a different potential source of the abnormal operation, such that a snapshot instance executed with a given limitation does not process incoming events from the potential source of the abnormal operation which is blocked by that limitation; determining a source of the abnormal operation using a snapshot instance from the set of snapshot instances that does not exhibit the abnormal operation because it includes a limitation that blocks the source of the abnormal operation; and updating a state of the virtual machine using the snapshot instance that includes the limitation that blocks the source of the abnormal operation. selecting, from the series of snapshots, a snapshot taken prior to the detection of the abnormal operation to execute as a set of snapshot instances; spawning the set of snapshot instances (210, 212) from the selected snapshot; concurrently executing snapshot instances from the set of snapshot instances, each of the set of snapshot instances including a respective set of limitations, wherein each limitation blocks a different potential source of the abnormal operation, such that a snapshot instance executed with a given limitation does not process incoming events from the potential source of the abnormal operation which is blocked by that limitation; determining a source of the abnormal operation using a snapshot instance from the set of snapshot instances that does not exhibit the abnormal operation because it includes a limitation that blocks the source of the abnormal operation; and updating a state of the virtual machine using the snapshot instance that includes the limitation that blocks the source of the abnormal operation.