As another comment noted, you would log into a ring buffer in memory constantly and only dump it after the event in question happened. But without an initial state at the start od the log, this may not be enough.