Rudder

Because it's cf-execd that does the logging. But we REALLY want to know when the user run the agent by hand, or when it is "rudder agent check".
Oh, and it would be good to have the source of the run exec in syslog (we have something for rudder agent check, but not for rudder agent run):

/var/log/syslog for 'rudder agent check':

May 24 16:45:01 agent1 CRON[7260]: (root) CMD (/opt/rudder/bin/rudder agent check >/dev/null)
May 24 16:45:01 agent1 CRON[7261]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
May 24 16:47:20 agent1 rudder[8044]: CFEngine(agent) rudder R: @@Common@@log_info@@hasPolicyServer-root@@common-root@@1@@common@@StartRun@@2017-05-24 16:47:19+00:00##8b099c38-5d93-4524-bb3e-bd28600c4c59@#Start execution with config [20170524-163121-feae8d01]
.....

/var/log/syslog for 'rudder agent run':

May 24 16:58:56 agent1 rudder[10266]: CFEngine(agent) rudder R: @@Common@@log_info@@hasPolicyServer-root@@common-root@@1@@common@@StartRun@@2017-05-24 16:58:55+00:00##8b099c38-5d93-4524-bb3e-bd28600c4c59@#Start execution with config [20170524-163121-feae8d01]
May 24 16:58:56 agent1 rudder[10266]: CFEngine(agent) rudder R: @@Common@@result_success@@hasPolicyServer-root@@common-root@@1@@Update@@None@@2017-05-24 16:58:55+00:00##8b099c38-5d93-4524-bb3e-bd28600c4c59@#Policy, tools and configuration library are already up to date. No action required.
...;