In addition, I've added a "processes" stanza to the cfengine configuration, which means that if any of the cfengine daemons are not running then the crontabbed cfagent run will restart them:
"cfenvd" restart "/usr/sbin/cfenvd"
"cfservd" restart "/usr/sbin/cfservd"
"cfexecd$" restart "/usr/sbin/cfexecd"
Note the regexp on cfexecd - it's to stop the "cfexecd -F" run from cron from matching.
A couple of other things:
- I think I found the problem with my "splaytime" directive: it's "SplayTime", not "splaytime"!
- I added the time class Hr04 to the tidy stanza. From running cfagent by hand it was clear that this was the most expensive operation - and it really does only need run once a day.