1. A network device comprising: a user interface circuit configured to receive a user input establishing a rule, wherein the rule describes (i) a first characteristic of an event, and (ii) an action to initiate in response to a predetermined threshold being met; a classifier configured to identify, based on the first characteristic described in the rule, events that have the first characteristic in the network device; a counter configured to count a number of the events that have the first characteristic in the network device as identified by classifier; and an action circuit configured to initiate the action described in the rule in response to the number of the events meeting the predetermined threshold in the rule, wherein the first characteristic includes one or more of the following: a reboot of the network device, a change in state of a processor of the network device, a change in state of a memory of the network device, a change in state of a port of the network device, a change in an attribute of a network interface of the network device, a user login to the network device, and a user logout of the network device; wherein the change in state of the processor or the memory is generated by (i) a reboot event or (ii) reloading of a program of the network device; wherein the change in state of the port is generated by (i) a loss of connectivity between the port and a network (ii) or a resumption of connectivity between the port and the network; wherein the attribute of the network interface includes (i) a speed or (ii) a duplex mode of the network interface; wherein the first characteristic for the user login includes (i) a number of login, (ii) a frequency of login, (iii) a duration of login, or (iv) a time of day of login; and wherein the first characteristic for the user logout includes (i) a number of logout, (ii) a frequency of logout, (iii) a duration of logout, or (iv) a time of day of logout.