Abstract: Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines.

Abstract: Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of both VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. One of these service engines is a load balancer. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: The virtualization of file system placeholders is described. In one embodiment, a method for virtualizing placeholders includes monitoring placeholder creation initiated by at least one archival operation, generating placeholder data in a separate data store from a file system, wherein the placeholder data comprises a plurality of placeholders that correspond with a plurality of archived files, and servicing access requests for at least one archived file of the plurality of archived files using the placeholder data.

Abstract: A first computer system calculates a first value as a function of a data block. A second computer system compares the calculated first value with each of a plurality of values in a plurality of entries, respectively. The plurality of entries include a plurality of storage location pointers, respectively, that correspond to a plurality of data blocks, respectively, that were transmitted to a storage system before the first computer system calculated the first value. If the first value compares equally to a value contained in one of the plurality of entries, a storage location pointer of the one entry is transmitted to the storage system, wherein the storage location pointer corresponds to a copy of the data block that was sent to the storage system before the first computer system calculated the first value. If the calculated first value does not compare equally with any value contained in the plurality of entries, the first computer system transmits the data block to the storage system.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: A method and apparatus for archiving web content is disclosed. In one embodiment, the method comprises monitoring internet activity associated with at least one computer, wherein web content is communicated during the internet activity and analyzing information associated with the internet activity in accordance with a policy. The policy is used to identify a portion of web content to be archived.

Abstract: A method and apparatus for recreating placeholders comprising selecting at least one object of information in an archive, determining a source location for the selected at least one object of information, accessing the selected at least one object of information, and recreating a placeholder from the selected at least one object of information.

Abstract: A plurality of data objects may be replicated across a plurality of computing nodes coupled to a network. The network may include a first node operable to initiate an update operation to update a plurality of replicas of a first object. If one or more of the replicas are not reachable then the update operation may update a subset (e.g., a quorum) but not all of the replicas. For each node on which one of the replicas was updated in the update operation, the node may add the object to a list of incoherent objects. The list of incoherent objects may subsequently be used to bring the lagging replicas in sync with the replicas that were updated. In another embodiment, a plurality of replicas of an object may be stored on a plurality of nodes, similarly as described above. A first node that stores a replica of the object may store a first timestamp associated with the replica on the first node.

Abstract: A plurality of data objects may be replicated across a plurality of computing nodes coupled to a network. The network may include a first node operable to initiate an update operation to update a plurality of replicas of a first object. If one or more of the replicas are not reachable then the update operation may update a subset (e.g., a quorum) but not all of the replicas. For each node on which one of the replicas was updated in the update operation, the node may add the object to a list of incoherent objects. The list of incoherent objects may subsequently be used to bring the lagging replicas in sync with the replicas that were updated. In another embodiment, a plurality of replicas of an object may be stored on a plurality of nodes, similarly as described above. A first node that stores a replica of the object may store a first timestamp associated with the replica on the first node.