Struct EventBuffer 

pub struct EventBuffer { /* private fields */ }

A restart-safe, FIFO event buffer backed by a single SQLite file.

Events are appended with enqueue while the upstream sink is unreachable and replayed in insertion order with drain_and_send once it recovers. The file is opened in WAL mode so buffered events survive a process restart.

Implementations

impl EventBuffer

pub fn new(path: impl AsRef<Path>, cap: usize) -> Result<Self>

Open (creating if absent) a buffer at path retaining at most cap events.

Enables WAL journaling and synchronous = NORMAL for a durability/perf balance, and creates the events table if it does not yet exist. Parent directories are created as needed.

pub fn from_config(config: &SqliteBufferConfig) -> Result<Self>

Open a buffer from operator SqliteBufferConfig.

pub fn cap(&self) -> usize

The maximum number of events this buffer retains before eviction.

pub fn journal_mode(&self) -> Result<String>

The SQLite journal_mode in force on this buffer’s connection ("wal" once opened).

pub fn synchronous(&self) -> Result<i64>

The SQLite synchronous level in force on this buffer’s connection (1 = NORMAL).

pub fn len(&self) -> Result<usize>

Number of events currently buffered.

pub fn is_empty(&self) -> Result<bool>

Whether the buffer currently holds no events.

pub fn enqueue(&self, event: &AuditEntry) -> Result<()>

Append event to the buffer.

The entry is serialized to JSON and stored as a BLOB. When the buffer would exceed its cap, the oldest events are evicted to make room and the METRIC_EVENTS_DROPPED counter is bumped by the number dropped — the loss is metered, never silent. Each accepted event bumps METRIC_EVENTS_BUFFERED.

pub async fn drain_and_send(&self, sink: &dyn AuditSink) -> Result<usize>

Replay buffered events to sink in insertion (FIFO) order.

Each event is sent and, only after the sink acknowledges it, deleted from the buffer — so a crash mid-flush replays at-least-once rather than losing data. Draining stops at the first sink failure (the upstream is treated as still-unreachable), leaving the remaining events buffered for a later retry. Returns the number of events flushed; each one bumps METRIC_EVENTS_FLUSHED.