A method for diagnosing performance of a network switch device includes a processor monitoring data generated by a sensor associated with a network switch device, the data related to states or attributes of the network switch device. The processor detects a determined condition in the operation of the network switch device related to the state or attribute. The processor generates an event trigger in response to detecting the determined condition and executes a forensic command in response to the event trigger. Executing the command includes sending information relevant to the determined condition for aggregation in computer storage and for analysis.