Embodiments of the present invention include systems and methods for minoring data packets upon triggering of events in a network device. In the network device, a usage event is specified, where occurrence of the usage event is indeterminable, at least partially, from the information contained in the data packets. When the network device receives a data packet via an input port, it processes the data packet as the data packet flows along a pipeline in the network device. If a specified usage event is triggered while being processed, the data packet is mirrored via an output port of the network device so that the mirrored data packet may be analyzed by an analysis engine.