We call network events incidents that disturb the normal behavior of one or more elements of an IP network. Routers, network interface cards, and IP links can fail or malfunction for many reasons. For example, operators may need to reboot a router for a software upgrade, an interface card may crash, and IP links may be overloaded because of a denial-of-service attack. Any of these network events can impact customer's traffic (packets can be lost or delayed, and, in extreme cases, customers may lose connectivity to parts of the network). When customers complain, network operators need to intervene to diagnose and, hopefully, fix the problem. In this work, we characterize network events according to their causes by using data collected from the Virtual Private Network (VPN) backbone of a large European provider. The European VPN network do not connect to Internet, but interconnects sites of over ten thousand enterprise networks.