Threshold crossing events for network element instrumentation and telemetric streaming

A method comprising:

• in a network device, obtaining one or more measurement values based on network traffic associated with the data frames;
• detecting a threshold-crossing event of a measurement value, wherein the threshold-crossing event is one of an indication and a precursor of one or more of an abnormal and unexpected event associated with the network traffic;
• responsive to the detecting, collecting a plurality of time series of measurement values of the network traffic by one or more components in the network device;
• and
• sending a combination of the plurality of time series as a telemetric data stream for analysis by a network management system related to the abnormal/unexpected event.

A computing system comprising:

• a processor;
• and
• memory storing instructions that, when executed, cause the processor to
• receive a combination of a plurality of time series of measurement values of network traffic from one or more network devices in a network, wherein each network device is configured to collect associated time series responsive to detection of a threshold-crossing event, wherein the threshold-crossing event is one of an indication and a precursor of one or more of an abnormal and unexpected event associated with the network traffic,
• analyze the combination of a plurality of time series to extract meaningful statistics for detecting the one or more of the abnormal and unexpected event, and
• determine a management task that is to be performed in the network based on the one or more of the abnormal and unexpected event.