In one embodiment a network device includes multiple interfaces including at least one egress interface, which is configured to transmit packets belonging to multiple flows to a packet data network, control circuitry configured to generate event-reporting data-items, each including flow and event-type information about a packet-related event occurring in the network device, a memory, and aggregation circuitry configured to aggregate data of at least some of the event-reporting data-items into aggregated-event-reporting data-items aggregated according to the flow and event-type information of the at least some event-reporting data-items, store the aggregated-event-reporting data-items in the memory, and forward one aggregated-event-reporting data-item of the aggregated-event-reporting data-items to a collector node, and purge the one aggregated-event-reporting data-item from the memory.