The /proc/net/xfrm_stat file is useful for IPsec incidents to understand if errors are happening in the node. The absolute values don't tell us much however and we often need to ask users for a second bugtool report, to know if the counters are increasing.

Instead, we should probably collect this file twice, with a short interval in between the two collections.