百度云操作系统默认被安装软件

操作系统是百度云提供的centos6.8

1.bcm-agent

感觉是虚拟机管理的软件，里面有很多collectdctl collectd-nagios collectd-tg utils_vl_lookup_test 监控程序

/opt/bcm-agent/var/lib/bcm-agent/bcm-agent.upgrader –update-url=http://download.bcm.baidubce.com/packages/collectd-x86_64.sh –signature-url=http://download.bcm.baidubce.com/packages/collectd-x86_64.sh.sig –certificate=/opt/bcm-agent/var/lib/bcm-agent/cert.pem /opt/bcm-agent/var/lib/bcm-agent/collectd-x86_64.sh

2.hosteye

这个应该是安全监控的
/opt/hosteye/bin/hosteye

3 hss

好像是做了一些系统日志监控
/opt/hss/bin/hsa
opt/hss/bin/hsa.upgrader –update-url=http://download.bcm.baidubce.com/packages/hsa –signature-url=http://download.bcm.baidubce.com/packages/hsa.sig –certificate=/opt/hss/lib/cert.pem –max-executable-size=104857600 /opt/hss/bin/hsa

opt目录下

avalokita（未知，后续有分析） bcm-agent hosteye hss rh

pstree系统进程

init─┬─NetworkManager─┬─dhclient
│ └─{NetworkManager}
├─abrtd
├─acpid
├─agetty
├─atd
├─auditd───{auditd}
├─bcm-agent.upgra───collectd───10*[{collectd}]
├─console-kit-dae───63*[{console-kit-da}]
├─crond
├─dbus-daemon
├─hald─┬─hald-runner─┬─hald-addon-acpi
│ │ └─hald-addon-inpu
│ └─{hald}
├─hosteye─┬─hosteye───15*[{hosteye}]
│ └─{hosteye}
├─hsa.upgrader───hsa───5*[{hsa}]
├─irqbalance
├─login───bash
├─5*[mingetty]
├─modem-manager
├─ntpd
├─rsyslogd───3*[{rsyslogd}]
├─sshd───sshd───bash───bash───pstree
├─turnserver───6*[{turnserver}]
├─udevd───2*[udevd]
└─wpa_supplicant

avalokita

Usage: avalokita [options] command_path [command options]

Options:

–restart-interval [seconds]

Interval of command restart. Can not less than 1. Default is 1.

–update-interval [seconds]

Interval of update URL check. Can not less than 1. Default is 300.

–update-url [URL]

Automatically fetch the newest version executable of the command from URL
and restart the command. This implies the argument --signature-url will
get a default value [URL + ".sig"] if --signature-url was not specified.

Thus, use --update-url without --signature-url is impossible.

–signature-url [URL]

Signature file for verify the executable which fetched from --update-url.
The certificate is specify by --certificate. Default is the URL specified
by --update-url and append ".sig".

The signature file was in PKCS#7 encoding and PEM format.

–certificate [filename]

Certificate(in PEM format) used for verify the signature. If this argument
absent, --signature-url and --update-url is ignored.

–max-executable-size [size]

The maximum executable size. If beyond the size, download will failed.
Default is 10485760(10MiB).

–file-lock [filename]

Singletonize the daemon by a file lock. If the file lock is locked, the
daemon will exit immediately. Default is "./daemon.pid".

–stdout-file [filename]

Redirect command's stdout to a file. Default is "./daemon.stdout.log".

–stderr-file [filename]

Redirect command's stderr to a file. Default is "./daemon.stderr.log".

–help

Print usage.

–version

Print version number.

Signals:

SIGTERM

kill command at first(first SIGTERM, then SIGKILL if command not exit in
several seconds), then quit.

SIGINT

just kill command(SIGTERM, after several seconds then SIGKILL), then
avalokita will run the command again.