A network device includes a plurality of ports; a switch configured to switch data frames between the plurality of ports; and a processor configured to obtain one or more measurement values based on network traffic associated with the data frames, responsive to detection of a threshold-crossing event of a measurement value, wherein the threshold-crossing event is one of an indication and a precursor of one or more of an abnormal and unexpected event associated with the network traffic, cause collection of a plurality of time series of measurement values of the network traffic by one or more components in the network device, and send a combination of the plurality of time series as a telemetric data stream for analysis by a network management system related to the abnormal/unexpected event.