Approaches for gathering packet processing information. A directed graph is used to represent the packet processing system. In response to each network packet input to the system, an associated, unique packet identifier is established for the network packet. Each input network packet is processed by one or more components of the system. For each input network packet, respective log data is stored by each of one or more components of the system that processed the input network packet. The log data includes data from the input network packet, and the associated identifier. Components of the device that processed a packet having a selected, associated packet identifier are determined by traversing the graph and searching for graph-connected nodes for which the represented components stored log data with the selected packet identifier. Data is output indicating the components that processed the packet having the selected packet identifier.