Abstract: A data storage management system comprises features for initiating failover orchestration jobs that invoke recovery resources on demand in a cloud computing environment. Backed up data that is stored persistently in the cloud computing environment may be rapidly restored within the cloud computing environment for use in disaster recovery and/or in test and verification scenarios. This approach may be contrasted to systems where a failover system is “always on” at the failover destination, such as having failover resources always up and running in the cloud computing environment. Such resources typically include a failover virtual machine (VM), a virtual machine datastore for the restored data, and one or more computing resources for restoring an auxiliary copy to the VM's datastore. The cloud-based failover resources are deactivated or taken down once the failover event ends.

Abstract: Systems and methods disclosed herein improve on current technology for block-level data replication to cloud computing environments. A new system architecture deploys one or more replication tail proxies in a cloud computing environment, locally (at the cloud) tracks replicated data and determines which replicated data meet criteria for reconstructing a desired point-in-time in the cloud, and persists data blocks received at the replication tail proxy until they are processed as recovery points. The disclosed approach presents resiliency and performance advantages. First, the resiliency of block-level data replication to cloud is improved by deploying the replication tail proxy in the destination cloud. Second, a Recovery Time Objective (RTO) is reduced by enabling faster cloud deployment of virtual machines for disaster recovery, failover, and/or test purposes based on the replicated data.

Abstract: Systems described herein may dynamically add one or more proxy agents to a cloud data storage system to process an information management job, such as restore job. Upon completion of the job or at some other appropriate interval, the system can power down and decommission the proxy agents and/or the virtual machines on which the proxies reside according to a cleanup schedule (e.g., at hourly or minute intervals). The system takes into account currently existing proxies or virtual machines when processing a restore request to determine the need for new proxies to service the restore request. In this manner the system can save costs and computing resources through efficient virtual machine deployment and retirement.

Abstract: Distributed architecture for executing information management services using shared platform microservices, containerization techniques, and regional core services. This architecture decentralizes the traditional model by segmenting the various functions of the centralized control and information manager into modular cloud microservices. This modularization not only enhances system flexibility but also allows for a more dynamic configuration, with certain elements being deployable as containers. The resilient architecture leverages the inherent scalability and adaptability of cloud technology.

Abstract: An information management system according to certain aspects may be configured to generate a snapshot of data relating to a plurality of applications. The system may include a plurality of data agents, wherein each data agent is associated with at least one of a plurality of applications, and data generated by the plurality of applications is stored in a logical volume in primary storage. The system may also include a snapshot manager configured to detect the plurality of applications; check with the plurality of data agents whether the associated applications are in consistent states; obtain a snapshot of the logical volume in response to receiving notifications from the plurality of data agents that the associated applications are in consistent states; and generate mapping information between a particular one of the plurality of applications and a portion of the snapshot relating to the particular one of the plurality of applications.

Abstract: An information management system can detect instances in which data is being stored in a non-standard file path and can alert the user of the client computing device, modify the storage policy to include the non-standard file path, and/or initiate a secondary copy operation to prevent data loss of the data stored in the non-standard file path. For example, a client computing device may execute a filter driver that monitors interactions with files in the file system. The filter driver can identify any non-standard file paths not subject to a storage policy that include files in which interactions occurred. For a non-standard file path, the filter driver can determine whether the frequency of interaction with files in the non-standard file path satisfies a threshold frequency. If the threshold is satisfied, then the filter driver may determine that the files should be subject to the storage policy and take appropriate action.

Abstract: The present inventors devised techniques and technologies that streamline the protection of data stored on shared file storage e.g., on file servers, network-attached storage (NAS), share drives, network shares, etc., in a data storage management system. Some embodiments feature a proxy-less backup configuration in which backup services hosts are assigned to perform a secondary copy job, at job runtime, based on host attributes relative to the data source. Some embodiments are configured to, at job runtime, automatically resolve data paths to the source data, and automatically mount the data paths, rather than requiring data paths to be expressly pre-administered on all possible candidate backup machines. Some embodiments automatically protect data from shared file storage that was not expressly given a backup plan (“undefined” data) by applying default preferences for protecting undefined data.

Abstract: An information management system according to certain aspects is provided to perform archiving based on third-party application rules and third-party metadata. The system may include a third-party archiving data agent that can access archiving rules and/or metadata of a third-party application. The third-party archiving data agent may be a data agent that can access archiving rules and/or metadata of a third-party application, and can include or be in the form of a plug-in for a particular third-party application. The third-party archiving data agent can decide whether to archive a file associated with a third-party application by checking the third-party metadata associated with the file and determining whether the metadata meets the third-party archiving rules. The system can perform the archiving on behalf of the third-party application, and in certain embodiments, notify the third-party application that the archiving has been completed.

Abstract: A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.

Abstract: Techniques are disclosed relating to providing fast access to restored data in a cloud storage environment. A computing system stores multiple sets of incremental backup data that reflect changes in data being backed up between backup intervals and metadata that indicates which set of incremental backup data stores a given object. The computing system generates an endpoint for a requesting computing system, where the endpoint supports requests for restored backup data and data responses. In response to a request from the requesting computing system via the endpoint, the computing system queries the metadata based on the request and stores metadata retrieved from the query in a key/value store using object identification information as key data and the retrieved metadata as value data. The computing system provides requested data according to a lazy loading technique, including providing requested data via the endpoint based on the metadata in the key/value store.

Abstract: Because Kubernetes clusters can be ephemeral, backing up in-cluster data to storage outside the cluster is important. Prior art solutions used the cluster's API server, which facilitates communications with the cluster control plane, to transfer backup data through the API server. However, the API server as a data transfer node has resiliency weaknesses and can slow down backup job performance. The present solution provides a more streamlined and scalable approach, which circumvents the API server and additionally includes more robust error checking, log capture, and realtime job monitoring to provide improved data protection resilience. The disclosed approach employs a “sponsor” data agent outside the cluster and temporarily deploys a specialized backup resource within the cluster during a backup job, such as an enhanced File System Data Agent and/or a lightweight Kubernetes File Client, both of which present substantial performance and resiliency advantages over the API server.

Abstract: An illustrative data storage management system protects data in a replicated multi-node system (“cluster”). The illustrative system creates a new administrative entity (“pseudo-client”) that represents the cluster within the system. The system intelligently performs as an adaptive “set it and forget it” system. Preferences for the pseudo-client, including alternate rules that cover various contingencies in the cluster, need not be reset as the cluster undergoes node failures and/or role changes over time. Rather, the disclosed system adapts, on each successive secondary copy job, to the current configuration of the cluster without requiring a system administrator to provide further input or analysis. This approach ensures that jobs can begin promptly as scheduled or on demand. Component selection is based at least in part on geography/zone and/or network topology considerations, which improves the likelihood of job completion and success, and RPO/RTO service levels are more likely to be met.

Abstract: Protecting configuration data in a clustered container system may include, in some embodiments, protecting an ETCD data store in a Kubernetes cluster. A data storage management system addresses the unique needs of protecting an ETCD data store of a target Kubernetes cluster, as well as protecting non-ETCD data payloads. The illustrative data storage management system defines ETCD as a unique kind of workload. ETCD protection is integrated within the data storage management system, which automatically creates data structures and resources within the system for, and provides special-purpose features to protect, ETCD contents and associated security certificates. One of the special-purpose features deploys a temporary data transfer agent within the target Kubernetes cluster to safeguard an ETCD snapshot and transmit its contents, along with the security certificates, to a backup infrastructure that operates outside of the target Kubernetes cluster.

Abstract: After completion of a backup job, the illustrative system performs a threat analysis of the freshly generated backup copies. Each copy is restored at a secure storage area. The system scans the restored data using, preferably, a signature-based malware scanning engine. If the scan finds malware infection or some other unsafe condition, a tracking index is updated to indicate that the copy is unsafe, and the secondary copy is quarantined. The quarantine prevents the copy from being restored to the production environment, and from acting as a source for other copies. The system iterates, scanning preceding versions of the copy, updating the index, and quarantining, until a clean or uninfected copy is found. The clean copy is so indexed. Responsive to a restore request, the illustrative system automatically restores the clean copy and skips over the infected copy/copies, preferably without asking the requesting user for input or approval.

Abstract: A distributed data storage system using erasure coding (EC) provides advantages of EC data storage while retaining high resiliency for EC data storage architectures having fewer data storage nodes than the number of EC data-plus-parity fragments. An illustrative embodiment is a three-node data storage system with EC 4+2. Incoming data is temporarily replicated to ameliorate the effects of certain storage node outages or fatal disk failures, so that read and write operations can continue from/to the storage system. The system is equipped to automatically heal failed EC write attempts in a manner transparent to users and/or applications: when all storage nodes are operational, the distributed data storage system automatically converts the temporarily replicated data to EC storage and reclaims storage space previously used by the temporarily replicated data. Individual hardware failures are healed through migration techniques that reconstruct and re-fragment data blocks according to the governing EC scheme.

Abstract: Data protection resources are automatically scaled to the needs of data source(s) in an application orchestrator computing environment, such as a cluster in a Kubernetes deployment. The approach is adaptable to data sources in production clusters or application suites that are not application orchestrator deployments, such as a cloud-based database-as-a-service (DBaaS). A data storage management system protects cluster-based data with an elastic number of data protection resources (e.g., data agents, media agents), which are deployed on demand. The number of data protection resources deployed for a particular job are appropriate to the workload(s) at present and depend on a variety of scaling factors. In some embodiments, data protection resources are deployed within the same cluster as the data sources.

Abstract: Ransomware detection accuracy is improved by analyzing patterns of changes in filename extension counts, relative to each other, that occur in a file system over time. The disclosed approach is malware-agnostic and does not rely on recognizing malware extensions or on real-time monitoring of the target file system. Instead, during each successive backup job of the target file system, the disclosed technology counts different types of filename extensions and compares the counts to each other and to corresponding counts taken in earlier backup jobs. Preferably, the anomaly detection analysis uses machine learning to discern a behavior pattern of the file system, which indicates how filename extensions are distributed and how much they change between backup jobs over time.

Abstract: A computer-implemented system and associated methods are disclosed, including components such as a client cloud computing environment, client computing devices, media agents, and a secondary storage subsystem managed by a throttle manager. The client cloud computing environment includes multiple virtual machines (VMs), each with a specific data agent responsible for collecting and transmitting application data. The secondary storage subsystem includes multiple secondary storage units managed by media agents. The throttle manager oversees the distribution and regulation of data streams across these media agents, dynamically adjusting the allocation of data streams to balance utilization and efficiently handle data. The system implements a multi-priority level bandwidth allocation mechanism, where bandwidth is distributed based on job type and dynamically adjusted based on stream performance.

Abstract: A streamlined approach enables customers to retain management control over their data in a database-as-a-service (“DBaaS”) setting, by providing managed backup copies outside cloud service providers' sphere of control. An illustrative data storage management system provides control over performing backup operations to generate managed backup copies, storing managed backup copies, recovering managed backup copies in whole or in part, migrating managed backup copies, and migrating DBaaS instances. Management control also extends to choices of where to store the managed backup copies, whether on the same cloud computing platform as the source DBaaS, on a different cloud computing platform, and/or in a non-cloud data center.

Abstract: An illustrative efficient failover process and system in virtualized environment to reduce costs and resources associated with maintaining live stand-by failover scheduling and maintenance system is described herein. The illustrative embodiment uses incremental backup data to maintain a failover or passive virtualized computing platforms comprising of one or more virtual machines that are configured to and ready to be scaled up and initiated to take over the tasks and operations of a lost storage manager. Each virtualized failover or passive node is initially configured to use minimal computing resources to maintain a live backup of the active storage manager. During a failover, a passive virtual node will initiate the failover process. In an embodiment, the failover process comprises restoring a secondary copy of the lost storage manager, initiating a scale up process to increase computing resources, and continuing scheduled tasks and operations of the lost storage manager.