Abstract: A system and method include associating, by a database system of a virtual computing system, a protection schedule with each source database provisioned in the database system, the protection schedule defining a frequency of capturing snapshots and a frequency of capturing transactional logs, capturing, by the database system for each of the source databases, snapshots and transactional logs based upon the frequency of capturing snapshots and the frequency of capturing transactional logs, respectively, and receiving, by the database system, a request identifying a point in time for creating a cloned database from a first source database. The system and method also include retrieving, by the database system, the snapshots and the transactional logs corresponding to the point in time and creating, by the database system, the cloned database by combining data in storage locations identified in the transactional logs and the data in remaining storage locations identified in the snapshots.

Abstract: A system and method include receiving, by a database engine of a database system associated with a virtual computing system, a user request via a dashboard for provisioning a source database with the database system, receiving, by the database engine via the dashboard, selection of a database engine type, and receiving, by the database engine via the dashboard, selection of a Service Level Agreement (“SLA”) and a protection schedule. The system and method also include provisioning, by the database engine, the source database based upon the database engine type, creating, by the database engine, an instance of a database protection system based upon the SLA and the protection schedule, including associating the instance of the database protection system with the source database, and displaying, by the database engine, the source database within the dashboard.

Abstract: A database system associated with a plurality of source databases in a virtual computing system includes a dashboard having a main menu for providing a plurality of control functions and a body that dynamically changes based upon the plurality of control functions that are selected. The dashboard includes a homepage for displaying a plurality of cells in the body, including a first cell for displaying a list of the plurality of source databases. The main menu includes a first control function, the selection of which triggers a database provisioning service by presenting options to either create a new source database or register an existing database within the body and a second control function, the selection of which triggers a copy data management service by presenting an option to create a new cloned database.

Abstract: A patching operation on an availability group cluster having a plurality of nodes is disclosed. The patching operation is performed in a plurality of iterations, each including determining a current state of each of the plurality of nodes, selecting a next node based on the current state, and patching the next node. A secondary replica node is selected as the next node before the a primary replica node. Each secondary replica node is patched in accordance with a first priority, upon patching each of the secondary replica node, a failover target node for patching the primary replica node is selected, the failover target node is selected based on a second priority, and according to the second priority, a healthy synchronous secondary replica node of the plurality of nodes is selected as the failover target node before an unhealthy synchronous secondary replica node of the plurality of nodes.

Abstract: In accordance with at least some aspects of the present disclosure, an apparatus is disclosed. In some embodiments, the apparatus includes a processor and a memory. In some embodiments, the memory includes programmed instructions that, when executed by the processor, cause the apparatus to receive a snapshot of a virtual object running on a first node, determine an original configuration associated with the virtual object from the snapshot of the virtual object, determine a resource need for the virtual object from the original configuration, determine that an available resource at the recovery node is insufficient to meet the resource need of the virtual object, generate a reconfigured configuration from the original configuration based at least on the resource need, and recover the virtual object at the recovery node based on the reconfigured configuration.

Abstract: An identity authentication management (IAM) service is established as a master over a master identity database of the centralized identity authentication management service. When adding an additional node to the computing infrastructure, a non-master copy of the master identity database is distributed to the additional node. Ongoing coordination between the master identity database and the non-master copy is established so as to synchronize differences between the master identity database and the non-master copy of the identity database. The additional node hosts a fully-functional authentication management service using the non-master copy of the master identity database and is able to respond to READ requests for data by accessing the non-master copy—without interaction with the centralized identity authentication management service.

Abstract: A system is provided that enables efficient traffic forwarding in a hypervisor. During operation, the hypervisor determines that a packet is from a first virtual machine (VM) running on the hypervisor and destined to a second VM running on a remote hypervisor. The hypervisor then includes a virtual local area network (VLAN) identifier of a transit VLAN (TVLAN) in a layer-2 header of the packet. The TVLAN is dedicated for inter-VM traffic associated with a distributed virtual routing (DVR) instance operating on the hypervisor and the remote hypervisor. Subsequently, the hypervisor sets a first media access control (MAC) address of the hypervisor as a source MAC address and a second MAC address of the remote hypervisor as a destination MAC address in the layer-2 header. The hypervisor then determines an egress port for the packet based on the second MAC address.

Abstract: Role-based access controls (RBAC) are extended to include multi-party authorizations for certain computing cluster operations or data items. Upon receiving a request to perform an operation over a computing cluster or its data, a check is carried out to determine if the operation (e.g., READ, WRITE, EXECUTE, DELETE, etc.) is subject to both a role-based access control as well as a multi-party authorization (MPA) consensus protocol. The determination to allow or deny the request includes (1) accessing a role-based access control record corresponding to the operation or data item, and (2) invoking the multi-party authorization consensus protocol. Prior to performance of the operation, a computer program collects “approve” or “deny” responses from individual ones of the multiple parties. When approval consensus is reached, the operation is performed. If approval is denied, or if an approval consensus is not reached within a time limit, then the operation is not performed.

Abstract: Methods, systems, and computer program products for thwarting a malware attack. A data storage system stores data items, some of which data items correspond to snapshots. Upon identification of a possible ransomware attack on a data item, the system identifies a version of the snapshot that is not subject to the ransomware attack and seeks to protect the data state of the system from further damage (e.g., due to performance of unauthorized operations on the version of the snapshot that is not subject to the ransomware attack) by requiring consensus from a multi-party authorization (MPA) consensus regime before carrying out requested operations over the snapshot. The MPA consensus regime operates by determining that the operation is subject to a role-based access control (RBAC) as well as a multi-party authorization (MPA) consensus protocol, and then allowing or denying execution of the requested operations based on achieving consensus from among candidate approvers.

Abstract: Placement scenario optimization mechanisms for automatic placement of computing entities onto nodes of a running multi-node computing cluster. A set of failure mode parameters define a high-availability requirement of the multi-node computing cluster. In advance of a failure event, and responsive to a determination that a then-current computing entity placement does not satisfy the high-availability requirement, the cluster is analyzed and a plurality of feasible placement scenarios are generated. Optimization criteria are applied to the feasible placement scenarios such that a best choice from among the feasible placement scenarios is identified and applied to the virtual machine placements over the cluster. A change monitoring and detection facility continually observes the multi-node computing cluster to detect a change of a failure mode parameter or to detect a change to the configuration of the virtual machines.

Abstract: A scalable multi-cluster resource sharing facility. A global witness process runs on a first computing platform that communicates over one or more networks to any number of nodes situated over two or more clusters. The global witness process listens on the network for occurrences of leadership and/or resource requests from nodes of different clusters. The global witness processes a request by retrieving a resource request and a respective last known state value, comparing the last known state value to a global stored state value, then storing a new state value when the respective last known state value is equal to the stored state value. Any number of contemporaneous requests can be processed by the global witness process, however only one request can be granted. The other requestors each receive a rejection of their resource request when their proffered last known state value is not equal to the stored state value.

Abstract: Methods, systems, and computer program products for flexible virtualization system deployment into different cloud computing environments. A set of floating licenses to virtualization system software components is established. The set of floating licenses are configured to permit usage of the virtualization system software components on different cloud computing infrastructures. Workload parameters of a workload to be deployed to one of the different cloud computing infrastructures is considered with respect to cloud attributes corresponding to the different cloud computing infrastructures. One or more candidate target cloud computing infrastructures are selected based upon a comparison between workload attributes of a computing workload and cloud attributes of the candidate target cloud computing infrastructures. Virtualization system software components are deployed into the selected target cloud computing infrastructures.

Abstract: Examples described herein include virtualized environments including a virtualized file server. Examples of file server virtual machine managers are described which may setup and/or configure file server virtual machines in accordance with a target number of connections and/or a target throughput for the virtualized file server. The virtualized file server may be scaled up, scaled down, scaled in, and/or scaled out.

Abstract: Methods, systems, and computer program products for selection of a witness during virtualization system recovery after a disaster event. A recovery plan is configured to identify a witness that is then used to elect a leader to implement the recovery. Various system, and/or network, and/or component failures and/or various loss of function of components of the virtualization system can trigger initiation of the recovery plan. Based on the particular recovery plan that is invoked upon a determination of a network outage, or component failure or loss of function of a component of the virtualization system, a particular witness corresponding to a subset of entities of the particular recovery plan is selected. The witness is used to elect the leader, and the leader initiates actions of the recovery plan. The implementation of the recovery plan includes consideration of the health of components that would potentially be involved in the recovery actions.

Abstract: A system and method include receiving, by a database engine of a database system associated with a virtual computing system, a user request via a dashboard for provisioning a source database with the database system, receiving, by the database engine via the dashboard, selection of a database engine type, and receiving, by the database engine via the dashboard, selection of a Service Level Agreement (“SLA”) and a protection schedule. The system and method also include provisioning, by the database engine, the source database based upon the database engine type, creating, by the database engine, an instance of a database protection system based upon the SLA and the protection schedule, including associating the instance of the database protection system with the source database, and displaying, by the database engine, the source database within the dashboard.

Abstract: In accordance with some aspects of the present disclosure, a non-transitory computer readable medium is disclosed. In some embodiments, the non-transitory computer readable medium includes instructions that, when executed by a processor, cause the processor to receive, from a workload hosted on a host of a cluster, first I/O traffic programmed according to a first I/O traffic protocol supported by a cluster-wide storage fabric exposed to the workload as being hosted on the same host. In some embodiments, the workload is recovered by a hypervisor hosted on the same host. In some embodiments, the non-transitory computer readable medium includes the instructions that, when executed by the processor, cause the processor to adapt the first I/O traffic to generate second I/O traffic programmed according to a second I/O traffic protocol supported by a repository external to the storage fabric and forward the second I/O traffic to the repository.

Abstract: A system may include a memory having computer-readable instructions stored thereon and a processor of a control plane that executes the computer-readable instructions to receive a request from a tenant to update a portion of a database, determine an individual tenant identifier of the tenant, determine whether the portion of the database is associated with the individual tenant identifier or a global tenant identifier, and allow the tenant to update the portion of the database in response to determining that the portion of the database is associated with the global tenant identifier or the individual tenant identifier or restrict the tenant from updating the portion of the database in response to determining that the portion of the database is associated with neither the global tenant identifier nor the individual tenant identifier.

Abstract: A database management system may include a control plane comprising a memory having computer-readable instructions stored thereon and processor that executes computer-readable instructions to execute one or more services running on the control plane, the control plane connected to a plurality of database servers, wherein each of the plurality of database servers is connected to the control plane via a communication channel, wherein the control plane comprises a plurality of data streams, each of the plurality of data streams configured to communicate messages of a designated type, and wherein the control plane is configured to communicate with a database server of the plurality of database servers using the plurality of data streams and the communication channel associated with the database server and the control plane.

Abstract: Aspects of the present disclosure are directed to a system comprising a memory having computer-readable instructions stored thereon, and a processor of a database server, the processor executing the computer-readable instructions to generate a request to a control plane for an operation to be performed on the database server, wherein the control plane is configured to communicate with a plurality of database servers having a plurality of agents running thereon, and wherein each of the plurality of agents has a dedicated communication connection with the control plane, publish the request on the dedicated communication connection associated with the agent to send the request to the control plane, receive, on the dedicated communication connection, a response from the control plane, the response comprising a response to the request from a service of the control plane, and execute the operation on the database server based on the response.

Abstract: A system may include a memory having computer-readable instructions stored thereon, and a processor of a control plane that executes the computer-readable instructions to receive from a database server, over a first connection, a request for credentials, in response to the request for credentials, generate credentials for the database server, transmit the credentials to the database server over a second connection specific to the database server, receive, over the second connection, from the database server, a request for registering the database server, the request for registering the database server comprising the credentials, in response to the request for registering the database server, register the database server with a database management system associated with the control plane.