Provided are methods and computer program products monitoring the contents of network traffic in a network device. Methods may include collecting, using a kernel space driver interface, network traffic data sent by and/or received at the network device, parsing the collected network traffic data to extract transaction data corresponding to at least one logical transaction defined by a network protocol and storing an indicator of a quantity of the collected network traffic data that was parsed, and generating an event incorporating the extracted transaction data.