sensor: restart cowrie after log rotation to clear sparse FD offset

Author: lopes

config/ansible/roles/profile_sensor_low/tasks/main.yml

@@ -64,8 +64,8 @@
 # --- HONEYPOTS LOG ROTATION --
 - name: "Set the honeypots log rotation"
   become: true
-  ansible.builtin.copy:
-    src: honeypots.logrotate
+  ansible.builtin.template:
+    src: honeypots.logrotate.j2
     dest: /etc/lantana/logrotate.d/00_00/honeypots
     owner: root
     group: root

config/ansible/roles/profile_sensor_low/templates/honeypots.logrotate.j2

@@ -12,4 +12,21 @@
     compress
     delaycompress
     copytruncate
+    sharedscripts
+    # Cowrie's Twisted writer holds the file descriptor across rotation and
+    # keeps appending at its remembered offset, leaving a sparse-null region
+    # at the start of the new file (op_alpha 2026-06-19: cowrie.json reported
+    # 149 MB, first non-null byte at offset 141 271 814 — Vector tails it
+    # fine but cat/jq inspection breaks and analyst debug is blocked).
+    # Restarting the rootless quadlet hands the writer a fresh FD pointing
+    # at offset 0. Cost: any cowrie SSH session active at the moment of
+    # rotation disconnects, losing a few seconds of intel — acceptable since
+    # the cron fires at 00:00 UTC and attacker sessions rarely span midnight.
+    # Dionaea's writer reopens cleanly on truncation so it doesn't need the
+    # same treatment.
+    postrotate
+        runuser -u {{ system.users.sensor.name }} -- \
+            env XDG_RUNTIME_DIR=/run/user/{{ system.users.sensor.uid }} \
+            systemctl --user restart cowrie.service >/dev/null 2>&1 || true
+    endscript
 }