1. An apparatus comprising: at least one port to exchange packets of data with one or more networks; a user interface circuit that allows a user to input a plurality of event classification rules, wherein: each of the event classification rules describes at least one event characteristic for an event in the apparatus, at least one of the event classification rules describes a plurality of the event characteristics, at least two of the event characteristics are selected from a group including a reboot of the apparatus, a change in state of a processor of the apparatus, a change in state of a memory of the apparatus, a change in state of the at least one port of the apparatus, a change in an attribute of a network interface of the apparatus, a user login, and a user logout, and the change in state of the at least one port is generated by a change in spanning tree mode; an event classifier to identify events having the at least one event characteristic described by any of the event classification rules; and a plurality of event counters each to count the events identified by the event classifier for a respective one of the event classification rules.