A non-transitory computer readable medium comprising computer executable instructions stored thereon that when executed by one or more processing units, cause the one or more processing units to perform a method to provide event ingestion throttling, the method comprising: obtaining an event associated with a first event queue from a plurality of event queues on a network communication device executing a service function and a monitoring function, the event responsive to a local database change on the network communication device, the first event queue associated with the monitoring function, the service function having a higher priority for the network communication device than the monitoring function, wherein the local database change comprises a database value change; determining if an event queue entry is available to be populated with event information for the first event queue; based on a determination that no event queue entry is available to be populated with event information, determining if the first event queue is full; based on a determination that the first event queue is full, setting a first indication to initiate throttling of events; determining if a total of in-use queue entries across the plurality of event queues is higher than a threshold, wherein a queue entry is in-use when it is actively being processed by a worker thread; based on a determination that the total of in-use queue entries is above the threshold, setting a second indication to initiate throttling of events; and providing the first indication and the second indication to an event scheduler monitor function, wherein the event scheduler monitor function determines whether or not to initiate throttling of events for the monitor function in favor of the service function based on a combination of the first indication and the second indication. obtaining an event associated with a first event queue from a plurality of event queues on a network communication device executing a service function and a monitoring function, the event responsive to a local database change on the network communication device, the first event queue associated with the monitoring function, the service function having a higher priority for the network communication device than the monitoring function, wherein the local database change comprises a database value change; determining if an event queue entry is available to be populated with event information for the first event queue; based on a determination that no event queue entry is available to be populated with event information, determining if the first event queue is full; based on a determination that the first event queue is full, setting a first indication to initiate throttling of events; determining if a total of in-use queue entries across the plurality of event queues is higher than a threshold, wherein a queue entry is in-use when it is actively being processed by a worker thread; based on a determination that the total of in-use queue entries is above the threshold, setting a second indication to initiate throttling of events; and providing the first indication and the second indication to an event scheduler monitor function, wherein the event scheduler monitor function determines whether or not to initiate throttling of events for the monitor function in favor of the service function based on a combination of the first indication and the second indication. <EOS>