A method and apparatus of a device that captures a stackshot of an executing process is described. In an exemplary embodiment, the device detects an interrupt of the process occurring during the execution of the process, where the process execution can be in a kernel space and user space, and the interrupt occurs during the user space. The device further determines whether to capture a stackshot during the interrupt using a penalty function. If the stackshot is to be captured, the device captures the stackshot and saves the stackshot.