A logistics company monitors 800 distribution-center switches for interface errors and buffer drops that spike for seconds during sortation peaks. SNMP polling every five minutes misses events and creates CPU spikes on collectors. Which model-driven telemetry publication choice should the designer recommend to reduce load impact while catching events?

The correct hybrid balances efficiency and fidelity because interface error counters are cumulative and best sampled on a controlled periodic subscription that avoids collector CPU spikes from synchronized SNMP walks, while buffer drops are bursty threshold-crossing events during sortation peaks that call for event-driven on-change publication of the event or state nodes the platform exposes for them (raw ever-incrementing counters are generally streamed periodically, not on-change) to capture second-scale spikes that five-minute polls miss. The five-minute periodic-only streaming choice is operationally sound for capacity trending and lowers load, but its cadence conceptually fails event timeliness because sub-minute bursts can rise and clear between samples. The universal on-change publication choice is widely used for state and threshold leaves, but it fails load control here because ever-incrementing counters would generate continuous updates and effectively recreate a flood. The moderate periodic plus delayed SNMP trap choice looks efficient and familiar for alarming, but it fails the model-driven requirement and event fidelity because relying on legacy traps with persistence dampening filters out the brief transients the business needs. Exam caveat: distinguish subscription type from transport, since dial-out versus polling does not fix a wrong cadence or event definition. Practical check: validate in YANG that buffer-drop leaves support on-change, pilot the combined subscriptions on a few switches during a peak, and confirm collector CPU stays flat while second-scale drops are recorded.