Abstract: Embodiments of the present disclosure relate to container-level monitoring. Embodiments include detecting, by an agent of a virtual machine, an event. Embodiments include determining, by the agent of the virtual machine, an address related to the event. Embodiments include accessing, by the agent of the virtual machine, container mapping information. Embodiments include locating, by the agent of the virtual machine, the address in the container mapping information. Embodiments include determining, by the agent of the virtual machine, based on the locating, that the event is associated with a container. Embodiments include determining, by the agent of the virtual machine, one or more attributes of the container. Embodiments include determining, by the agent of the virtual machine, based on information related to the event and the one or more attributes of the container, whether to block or allow an action related to the event.

Abstract: In some embodiments, a method receives one or more address resolution mappings and sends the one or more first address resolution mappings to a manager for verification of the one or more first address resolution mappings. The method receives one or more responses based on the verification of the one or more first address resolution mappings and allows or disallows use of the one or more address resolution mappings based on the one or more responses. A list of verified address resolution mappings is received from the manager based on the verification of the one or more first address resolution mappings. Then, the method receives a second address resolution mapping and verifies the second address resolution mapping using the list of verified address resolution mappings.

Abstract: Example methods are provided for adaptive file access authorization using process access patterns. In a learning mode, attributes and other information, which are associated with applications or with processes that are related to the applications and that attempt to access a file system, are collected and used to generate a policy. In a protected mode, file access requests are examined against the policy, and are granted access to the file system or are denied access to the file system based on the contents of the policy. The policy may be updated so as to adapt to changes in the access patterns and to changes in the application or processes.

Abstract: Techniques for implementing a secure enclave-based guest firewall are provided. In one set of embodiments, a host system can load a policy enforcer for a firewall into a secure enclave of a virtual machine (VM) running on the host system, where the secure enclave corresponds to a region of memory in the VM's guest memory address space that is inaccessible by processes running in other regions of the guest memory address space (including privileged processes that are part of the VM's guest operating system (OS) kernel). The policy enforcer can then, while running within the secure enclave: (1) obtain one or more security policies from a policy manager for the firewall, (2) determine that an event has occurred pertaining to a new or existing network connection between the VM and another machine, and (3) apply the one or more security policies to the network connection.

Abstract: Various systems and methods are provided for using various in-core and on-disk data structures to improve the file creation process through the use of previously-occupied inodes. For example, one method involves updating an in-core data structure in response to receiving a command to delete a first file, such that a first node is assigned to the first file, the in-core data structure is stored in a non-persistent computer-readable storage medium, the in-core data structure comprises a plurality of entries, each of the entries comprises information identifying a respective inode of a plurality of inodes as being available, and the updating the in-core data structure comprises storing information regarding the first inode in a first entry of the plurality of entries; and creating a second file, where the creating comprises assigning the first inode to the second file using the information regarding the first inode stored in the first entry.

Abstract: Network-efficient isolation environment redistribution is described. In one example, network communications are surveyed among isolation environments, such as virtual machines (VMs) and containers, hosted on a cluster. An affinity for network communications between the isolation environments can be identified based on the survey. Pairs or groups of the isolation environments can be examined to identify ones which have an affinity for network communications between them but are also hosted on different host machines in the cluster. The identification of the affinity for network communications provides network-level context for migration decisions by a distributed resource scheduler. Certain VMs and containers can then be migrated by the distributed resource scheduler to reduce the network communications in the cluster based on the network-level context information.

Abstract: Various systems, methods and apparatuses for coordinating the sharing of cache data between cluster nodes operating on the same data objects. One embodiment involves a first node in a cluster receiving a request for a data object, querying a global lock manager to determine if a second node in the cluster is the lock owner of the data object, receiving an indication identifying the second node as the lock owner and indicating that the data object is available in the second node's local cache, requesting the data object from the second node, and then receiving the data object from the second node's local cache. Other embodiments include determining whether the lock is a shared lock or an exclusive lock, and either pulling the data object from the local node of the second cache or receiving the data object that is pushed from the second node, as appropriate.

Abstract: The disclosed computer-implemented method for improving the efficiency of point-in-time representations of databases may include (1) identifying a database that includes (A) one or more utilized storage locations that store substantive data and (B) one or more empty storage locations that are not currently storing any substantive data, (2) creating a point-in-time representation of the database by (A) identifying the empty storage locations and (B) flagging the empty storage locations in connection with the point-in-time representation of the database, (3) detecting a request to write certain substantive data to at least one of the empty storage locations, and then in response to detecting the request, (4) satisfying the request while refraining from performing a copy-on-write operation on the empty storage location due at least in part to the empty storage location not currently storing any substantive data. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for managing delayed allocation on clustered file systems may include (i) receiving, at a global lock manager that stores storage disk allocation information for a plurality of nodes in a clustered file system, a lock request from a node that requests a lock range on a storage disk to store data from a file, (ii) reserving, by the global lock manager, the lock range, (iii) receiving, at the global lock manager, from an additional node, an additional lock request for an additional lock range to store additional data from the file, and (iv) reserving, by the global lock manager, the additional lock range to be adjacent to the lock range on the storage disk based on the additional data on the additional node being from the same file as the data on the node. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for improving the efficiency of point-in- time representations of databases may include (1) identifying a database that includes (A) one or more utilized storage locations that store substantive data and (B) one or more empty storage locations that are not currently storing any substantive data, (2) creating a point-in-time representation of the database by (A) identifying the empty storage locations and (B) flagging the empty storage locations in connection with the point-in-time representation of the database, (3) detecting a request to write certain substantive data to at least one of the empty storage locations, and then in response to detecting the request, (4) satisfying the request while refraining from performing a copy-on-write operation on the empty storage location due at least in part to the empty storage location not currently storing any substantive data. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Various systems and methods for adjusting threshold access frequency based on cache pressure are disclosed. The threshold access frequency is adjusted based on a block of data in a storage volume that has an access frequency matching or exceeding the threshold access frequency. The threshold access frequency is used to determine whether the block of data should be inserted into the cache from the storage volume.

Abstract: Various systems, methods and apparatuses for coordinating the sharing of cache data between cluster nodes operating on the same data objects. One embodiment involves a first node in a cluster receiving a request for a data object, querying a global lock manager to determine if a second node in the cluster is the lock owner of the data object, receiving an indication identifying the second node as the lock owner and indicating that the data object is available in the second node's local cache, requesting the data object from the second node, and then receiving the data object from the second node's local cache. Other embodiments include determining whether the lock is a shared lock or an exclusive lock, and either pulling the data object from the local node of the second cache or receiving the data object that is pushed from the second node, as appropriate.

Abstract: A computer-implemented method for mitigating write-back caching failures may include (1) detecting a failure that impairs at least one write-back cache that temporarily caches updates for individual files stored on a storage device, (2) identifying an attribute of an individual file stored on the storage device in response to the failure that impairs the write-back cache, (3) determining that at least a portion of the individual file is obsolete based at least in part on the attribute of the individual file, and then (4) performing at least one mitigating action with respect to the individual file to address the obsolete portion of the individual file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Caching metadata that identify hot blocks at a per local cache level are tracked. Tracked caching metadata are maintained so as to be persistent and shared across nodes of the cluster. Local caches are pre-warmed by using maintained caching metadata, responsive to detecting specific node level events. Such events can result in hot blocks being absent from a local cache, such as a failover between nodes or an unexpected failure local to a specific node. Another event example is the access of shared storage content, such as opening a file or mounting a file system by a specific node, in response to which the associated local cache can be pre-warmed using the tracked caching metadata for the specific file, or for each file of the file system. To pre-warm a local cache, hot blocks of stored content identified by corresponding caching metadata are loaded into the local cache.

Abstract: A computer-implemented method for providing caching for applications with solid-state storage devices may include (1) identifying a plurality of solid-state drives that are available for caching input/output operations, (2) detecting at least one distinguishing hardware property of at least one solid-state drive within the plurality of solid-state drives, (3) determining at least one attribute of an application, and (4) selecting the solid-state drive for caching at least one input/output operation of the application based at least in part on the attribute of the application in combination with the distinguishing hardware property of the solid-state drive. Various other methods, systems, and computer-readable media are also disclosed.