Don't add messages when accumulated bytes exceeds threshold (#932)

* Don't add messages when accumulated bytes exceeds threshold

* Add a leniency factor

* lint

Source/santad/Logs/EndpointSecurity/Writers/Spool.h

@@ -58,7 +58,11 @@ class Spool : public Writer, public std::enable_shared_from_this<Spool> {
   dispatch_source_t timer_source_ = NULL;
   ::fsspool::FsSpoolWriter spool_writer_;
   ::fsspool::FsSpoolLogBatchWriter log_batch_writer_;
-  size_t spool_file_size_threshold_;
+  const size_t spool_file_size_threshold_;
+  // Make a "leniency factor" of 20%. This will be used to allow some more
+  // records to accumulate in the event flushing fails for some reason.
+  const double spool_file_size_threshold_leniency_factor_ = 1.2;
+  const size_t spool_file_size_threshold_leniency_;
   std::string type_url_;
   bool flush_task_started_ = false;
   void (^write_complete_f_)(void);

Source/santad/Logs/EndpointSecurity/Writers/Spool.mm

@@ -51,6 +51,8 @@
       spool_writer_(absl::string_view(base_dir.data(), base_dir.length()), max_spool_disk_size),
       log_batch_writer_(&spool_writer_, SIZE_T_MAX),
       spool_file_size_threshold_(max_spool_file_size),
+      spool_file_size_threshold_leniency_(spool_file_size_threshold_ *
+                                          spool_file_size_threshold_leniency_factor_),
       write_complete_f_(write_complete_f),
       flush_task_complete_f_(flush_task_complete_f) {
   type_url_ = kTypeGoogleApisComPrefix + ::santa::pb::v1::SantaMessage::descriptor()->full_name();
@@ -119,16 +121,22 @@
 #endif
     any.set_type_url(type_url_);
 
-    auto status = shared_this->log_batch_writer_.WriteMessage(any);
-    if (!status.ok()) {
-      LOGE(@"ProtoEventLogger::LogProto failed with: %s", status.ToString().c_str());
-    }
-
-    shared_this->accumulated_bytes_ += moved_bytes.size();
     if (shared_this->accumulated_bytes_ >= shared_this->spool_file_size_threshold_) {
       shared_this->Flush();
     }
 
+    // Only write the new message if we have room left.
+    // This will account for Flush failing above.
+    // Use the more lenient threshold here in case the Flush failures are transitory.
+    if (shared_this->accumulated_bytes_ < shared_this->spool_file_size_threshold_leniency_) {
+      auto status = shared_this->log_batch_writer_.WriteMessage(any);
+      if (!status.ok()) {
+        LOGE(@"ProtoEventLogger::LogProto failed with: %s", status.ToString().c_str());
+      }
+
+      shared_this->accumulated_bytes_ += moved_bytes.size();
+    }
+
     if (shared_this->write_complete_f_) {
       shared_this->write_complete_f_();
     }