1. A network device comprising: at least one port configured to exchange packets of data with one or more networks; a rule storing circuit configured to store a plurality of event classification rules, wherein: each of the event classification rules describes at least one event characteristic for an event in the network device, at least one of the event classification rules includes a change in state of the at least one port of the network device, and the change in state of the at least one port is generated by a change in spanning tree mode; an event classifier configured to identify events having the at least one event characteristic described by any of the event classification rules; and a plurality of event counters, wherein each of the event counters is configured to count the events identified by the event classifier for a respective one of the event classification rules.