EVENT AGGREGATION IN A DISTRIBUTED PROCESSOR SYSTEM

A method in a security device for processing network flows includes storing local counter values for one or more events and providing global event counters to maintain event statistics for events in the security device. In one embodiment, the method stores local counter value of an event for each packet processor reporting the event in a counter memory and the method sums the local counter values of an event stored in the counter memory to generate the global counter sum value for the event. In another embodiment, the method compares the global counter sum to a threshold value to put the event in a conforming state or non-conforming state. The method sends a multicast message to the interested packet processors indicating an event has transitioned to a non-conforming state.