Abstract: In various embodiments, a computer-implemented method comprises receiving, from a first endpoint device, a first event during a first time period, modifying an event log to include a record associated with the first event, causing a rollup queue to include a request to count a first count value associated with the first event, and generating, in a second time period subsequent to the first time period, a counter value associated with at least the first event based on the rollup queue and the event log.