Some embodiments may be associated with a cloud computing environment. A device layer may execute a kernel and determine that a write to disk storage is requested by an application executing in the cloud computing environment. A kernel function at the device layer may mark buffers of a page in a page cache that correspond to the requested write as dirty. An event-driven mechanism may send an event to an entry handler in user space, wherein the event has a block number associated with the dirty buffer as a payload. the block numbers received via events may be accumulated in the user space until it is determined that a pre-determined condition associated with the accumulated block numbers is satisfied. At that point, blocks associated with the accumulated block numbers may be saved to a persistent data store as an incremental backup.