Abstract: A host server in a server cluster has a memory allocator that creates a dedicated host application data cache in storage class memory. A background routine destages host application data from the dedicated cache in accordance with a destaging plan. For example, a newly written extent may be destaged based on aging. All extents may be flushed from the dedicated cache following host server reboot. All extents associated with a particular production volume may be flushed from the dedicated cache in response to a sync message from a storage array.

Abstract: A host server in a server cluster has a memory allocator that creates a dedicated host application data cache in storage class memory. A background routine destages host application data from the dedicated cache in accordance with a destaging plan. For example, a newly written extent may be destaged based on aging. All extents may be flushed from the dedicated cache following host server reboot. All extents associated with a particular production volume may be flushed from the dedicated cache in response to a sync message from a storage array.

Abstract: A host server in a server cluster has a memory allocator that creates a dedicated host application data cache in storage class memory. A background routine destages host application data from the dedicated cache in accordance with a destaging plan. For example, a newly written extent may be destaged based on aging. All extents may be flushed from the dedicated cache following host server reboot. All extents associated with a particular production volume may be flushed from the dedicated cache in response to a sync message from a storage array.

Abstract: A host server in a server cluster has a memory allocator that creates a dedicated host application data cache in storage class memory. A background routine destages host application data from the dedicated cache in accordance with a destaging plan. For example, a newly written extent may be destaged based on aging. All extents may be flushed from the dedicated cache following host server reboot. All extents associated with a particular production volume may be flushed from the dedicated cache in response to a sync message from a storage array.

Abstract: A system, computer program product, and computer-executable method of detecting malware in a virtual machine (VM), the computer-executable method comprising periodically creating snapshots of the VM, analyzing each of the snapshots in comparison to one or more previous snapshots to determine whether anomalies exist, and based on a threshold amount of anomalies detected, scanning the VM to determine whether malware is detected.

Abstract: A host server in a server cluster has a memory allocator that creates a dedicated host application data cache in storage class memory. A background routine destages host application data from the dedicated cache in accordance with a destaging plan. For example, a newly written extent may be destaged based on aging. All extents may be flushed from the dedicated cache following host server reboot. All extents associated with a particular production volume may be flushed from the dedicated cache in response to a sync message from a storage array.

Abstract: A computer program product, system, and method for generating coded fragments comprises intercepting, at a splitter, a write request from a host to storage, the write request comprising write data; sending the write request to a data protection appliance (DPA); calculating a probability of ransomware within the host; if the probability of ransomware is less than or equal to a first threshold, sending an acknowledgement (ACK) to the splitter; if the probability of ransomware is greater than a first threshold value and less than or equal to a second threshold value, creating a bookmark and sending an ACK to the splitter; and if the probability of ransomware is greater than the second threshold value, sending a delayed ACK to the splitter.

Abstract: A computer implemented method, system, and computer comprising intercepting an production IO at a splitter, determining if the production IO is a write IO, based on a positive determination of a write IO; replicating a copy of the write IO, based on a negative determination, determining if the production IO is a read IO and based on a positive determination of a read IO; replicating to metadata of the read IO.

Abstract: A System, Computer Program Product, and Computer-executable method for testing a production system, the System, Computer Program Product, and Computer-executable method including receiving information related to the production system, receiving production data from the production system, creating a virtual production system based off the production system using the received information and the received production data, and analyzing the production system by performing tests on the virtual production system.

Abstract: Example embodiments of the present invention relate to a method, an apparatus, and a computer program product for directing I/Os for a chunk of data to a data storage system on which the chunk of data is stored. The host method includes receiving an I/O for a chunk of data, identifying to which data storage system the I/O should be sent to access the chunk of data, and sending the I/O for the chunk of data to the identified data storage system. Other example embodiments of the present invention relate to a method, an apparatus, and a computer program product for handling received I/Os during a migration of the chunk of data. The data storage system method includes migrating the chunk of data, queuing an I/O for the chunk of data received from a host during the migration, and rejecting the queued I/O as a result of the migration.

Abstract: A computer program product, system, and method for generating coded fragments comprises receiving a request to generate a memory snapshot for a virtual machine (VM), copying the VM's memory to generate a memory snapshot, obtaining information about cache structures within the memory snapshot, invalidating one or more of the cache structures and zeroing out corresponding cache data within the memory snapshot, and storing the memory snapshot to storage.

Abstract: A method system and program product for sending a hint from the server to the storage array, the hint relating access requests of data stored on the storage array, receiving the hint at the storage array, and updating information about the data stored on the storage array using the hint.

Abstract: A computer program product, system, and method for generating coded fragments comprises initializing historical I/O activity data structures and recent I/O activity data structures associated with a logical unit (LU) of storage; receiving an I/O request from a host, the I/O request associated with one or more chunks within the LU; adding metadata about the I/O request to the recent I/O activity data structures; generating a ransomware probability by comparing the recent I/O activity data structures to the historical I/O activity data structures; and if the ransomware probability exceeds a first threshold value, taking one or more first actions to mitigate the effects of ransomware within the host.

Abstract: A method, system, and computer program product for data consistency, the system comprising receiving an IO from an application at a server cache, writing the IO to a location on the server cache as to not overwrite the previous data to which the IO is directed, updating, in the server cache, the location of the data to correspond to the location where the IO was written and recording the location of the previous data in a log.

Abstract: A processing device in one embodiment comprises a processor coupled to a memory and is configured to intercept a storage communication directed over a storage channel between a potentially infected machine and an associated storage system, and to determine if the intercepted storage communication is from a security agent deployed on the potentially infected machine. If the intercepted storage communication is from the security agent, at least a portion of the communication is provided to a security system. If the intercepted storage communication is not from the security agent, the communication is forwarded to the storage system. Accordingly, the security agent is configured to communicate with the security system using storage communications sent over the storage channel in a manner that avoids detection of the security agent by malware that may be installed on the machine and configured to monitor network communications.

Abstract: Example embodiments of the present invention relate to methods, systems, and a computer program product for detecting and responding to the presence of persistently executing malware. The method includes receiving a host-level I/O log and receiving a storage-level I/O log. An analysis may be performed on the host-level I/O log and the storage-level I/O log and evidence of malware may be detected according thereto.

Abstract: Embodiments described herein perform cleanup of backup images of a storage system by applying a record of I/O operations recorded while performing anti-malware operations on the storage system. The recording of the I/O operations can be replayed to resolve malware infections in the backup images, snapshots, or replicas of the storage system without requiring a restore-cleanup cycle for each backup image.

Abstract: A computer-executable method, system, and computer program product for managing a flash cache module in a data storage system, wherein the data storage system is in communication with a data storage array, the computer-executable method comprising receiving a request to write a first data block to the flash cache module; analyzing the flash cache module to determine if there is a free portion of memory on the flash cache module for the first data block; and upon a negative determination, writing the first data block to a used portion of memory on the flash cache module.

Abstract: A computer implemented method, computer program product and comprising rolling an image to a point in time in a protection window by applying write data using write metadata and examining read metadata, the write data, and the write metadata to determine if the image was accessed by an intruder.

Abstract: A computer-executable method, system, and computer program product for managing a data storage system using a distributed write-through cache, wherein the data storage system comprises a first node, a second node, and a data storage array, wherein the first node includes a first cache and the second node includes a second cache, the computer-executable method, system, and computer program product comprising providing cache coherency on the data storage system by synchronizing the second cache with the first cache based on I/O requests received at the first node.