Stop session analyzer failures when there are zero events

Due to Windows event log spam (tracked in bug 1070362) there is no
guarantee that there will be enough system session events to do
analysis and, in fact, there is no guarantee that there will be *any*
system session events. This means that FetchEvents is unavoidably flaky
and must be disabled, and ValidateEvents has to tolerate another failure
mode.

Bug: 1053451, 1070362
Change-Id: Ib95701d42f1152c6e7726bd7c6de913d6764ac4c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2314667Reviewed-by: Jesse McKenna <jessemckenna@google.com>
Commit-Queue: Bruce Dawson <brucedawson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#791279}

components/metrics/system_session_analyzer/system_session_analyzer_win.cc

@@ -119,6 +119,11 @@ SystemSessionAnalyzer::Status SystemSessionAnalyzer::IsSessionUnclean(
     // code so that a truncated system log doesn't cause failures.
     if (GetExtendedFailureStatus() == ExtendedStatus::EVENT_COUNT_MISMATCH)
       return INSUFFICIENT_DATA;
+    // Similarly, zero events in the error log is a special-case with its own
+    // error code so that a severely truncated system log doesn't cause
+    // failures.
+    if (GetExtendedFailureStatus() == ExtendedStatus::RETRIEVE_EVENTS_FAILURE)
+      return INSUFFICIENT_DATA;
     return INITIALIZE_FAILED;
   }
 

components/metrics/system_session_analyzer/system_session_analyzer_win_unittest.cc

@@ -24,7 +24,11 @@ const uint16_t kIdSessionEndUnclean = 6008U;
 }  // namespace
 
 // Ensure the fetcher retrieves events.
-TEST(SystemSessionAnalyzerTest, FetchEvents) {
+// Due to https://crbug.com/1053451 which is caused by a Windows "bug" tracked
+// by https://crbug.com/1053451 this cannot be made reliable. Running
+// browser_tests can and does generate so much event logging (DCOM events) that
+// none of the looked for events remain.
+TEST(SystemSessionAnalyzerTest, DISABLED_FetchEvents) {
   SystemSessionAnalyzer analyzer(0);
   std::vector<SystemSessionAnalyzer::EventInfo> events;
   ASSERT_TRUE(analyzer.FetchEvents(1U, &events));
@@ -39,7 +43,8 @@ TEST(SystemSessionAnalyzerTest, ValidateEvents) {
   auto is_session_unclean = analyzer.IsSessionUnclean(base::Time::Now());
   // If the system event log rate is high enough then there may not be enough
   // events to make a clean/unclean determination. Check for this situation and
-  // don't treat it as a failure. See https://crbug.com/968440 for details.
+  // don't treat it as a failure. See https://crbug.com/968440 and
+  // https://crbug.com/1053451 for details.
   if (is_session_unclean == SystemSessionAnalyzer::INSUFFICIENT_DATA) {
     // This warning can be ignored, but it does mean that our clean/unclean
     // check did not give an answer.