Abstract: Systems and methods for identifying anomalous activities in a cloud computing environment are provided. According to one embodiment, a customer's infrastructure may be fortified by leveraging deep learning technology (e.g., an encoder-decoder machine-learning (ML) model) to predict events in the cloud environment. During a training phase, the ML model may be trained to make a prediction regarding a next event based on a predetermined or configurable length of a sequence of contextual events. For example, historical events (e.g., cloud application programming interface (API) events logged to a cloud activity trace) observed within the customer's cloud infrastructure over the course of a particular date range may be split into appropriate event/context pairs and fed to the ML model. Subsequently, during a run-time anomaly detection phase, the ML model may be used to predict a next event based on a sequence of immediately preceding events to facilitate identification of anomalous activity.

Abstract: Technology is disclosed for bridging clouds of computing devices for compute and data storage. The technology can receive a virtual routing table (VRT), wherein the VRT indicates an association with a virtual local area network (VLAN) and defines neighbors for each route wherein at least one neighbor is defined for each of the two different cloud service providers, wherein the route definition creates a private transitive network between the neighbors; receive from a first node a first message destined for a second node; determine that the first message employs the route specified by the VRT; forward the first message to the second node; receive from a third node a second message destined for the second node; determine that the second message does not employ the route specified by the VRT; and fail to forward the second message to the second node.

Abstract: Methods, non-transitory computer readable media, and devices that more effectively manage snapshots by creating a namespace including files described by stored file recipe objects and each comprising fragments, directories described by metadata in the file recipe objects and each comprising one or more of the files, and snapshots described by stored snapshot request objects. Content of one of the directories are identified based on an identification of corresponding ones of the file recipe objects that existed within the namespace at a specified time. At least one of the files, included in the identified content and existing within the namespace at the specified time, is accessed in response to one or more received requests. A garbage collection operation is periodically performed to delete the recipe objects that are marked for deletion by tombstone objects and are unreferenced by any of the snapshots as determined based on the snapshot request objects.

Abstract: Techniques are provided for a layout format for compressed data. A first set of data blocks are grouped into a first group based upon a first frequency of access to the first set of data blocks. A second set of data blocks are grouped into a second group based upon a second frequency of access to the second set of data blocks. The first set of data blocks are compressed into a first compression group using a first compression algorithm. The second set of data blocks are compressed into a second compression group using a second compression algorithm.

Abstract: Techniques are provided for journal replay optimization. A distributed storage architecture can implement a journal within memory for logging write operations into log records. Latency of executing the write operations is improved because the write operations can be responded back to clients as complete once logged within the journal without having to store the data to higher latency disk storage. If there is a failure, then a replay process is performed to replay the write operations logged within the journal in order to bring a file system up-to-date. The time to complete the replay of the write operations is significantly reduced by caching metadata (e.g., indirect blocks, checksums, buftree identifiers, file block numbers, and consistency point counts) directly into log records. Replay can quickly access this metadata for replaying the write operations because the metadata does not need to be retrieved from the higher latency disk storage into memory.

Abstract: A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.

Abstract: Methods and systems for solid state drives are provided, including assigning a first shared namespace to a first instance and a second instance of a storage operating system for enabling write access to the first instance to a first zone of a first portion of a flash storage system, and write access to the second instance to a second zone of the first portion; using a first exclusive namespace by the first instance to store metadata at a first segment of a second portion of the flash storage system; using a second exclusive namespace by the second instance to store metadata at a second segment of the second portion of the flash storage system; and providing read only access to the first instance and the second instance to a second zone of the first portion using the first namespace.

Abstract: The disclosed technology relates to determining physical zone data within a zoned namespace solid state drive (SSD), associated with logical zone data included in a first received input-output operation based on a mapping data structure within a namespace of the zoned namespace SSD. A second input-output operation specific to the determined physical zone data is generated wherein the second input-output operation and the received input-output operation is of a same type. The generated second input-output operation is completed using the determined physical zone data within the zoned namespace SSD.

Abstract: Systems and methods for file system management are provided. According to one embodiment, a non-transitory computer-readable medium comprises instructions that when executed by the processing resource cause the processing resource to implement, in a storage node, a multi-tiered file system comprising a read-only layer that contains a base configuration for the storage node and a read-write layer that contains modifications to the base configuration; and combine the read-only layer and the read-write layer into an overlay file system to be presented to an operating system.

Abstract: Techniques are provided for data management across a persistent memory tier and a file system tier. A block within a persistent memory tier of a node is determined to have up-to-date data compared to a corresponding block within a file system tier of the node. The corresponding block may be marked as a dirty block within the file system tier. Location information of a location of the block within the persistent memory tier is encoded into a container associated with the corresponding block. In response to receiving a read operation, the location information is obtained from the container. The up-to-date data is retrieved from the block within the persistent memory tier using the location information for processing the read operation.

Abstract: Systems and methods for performing single I/O writes are provided. According to one embodiment, responsive to receipt of a write operation from a client by a file system layer of a node of a distributed storage system and a data payload of the operation having been determined to meet a compressibility threshold, an intermediate storage layer of the node logically interposed between the file system layer and a block storage media is caused to perform a single input/output (I/O) write operation that persists the compressed data payload and corresponding metadata to support asynchronous journaling of the write operation. The single I/O write operation coupled with the use of a new pool file that maintains a list of available blocks for single I/O write operations and a modified node crash recovery approach allows the write operation to be acknowledged to the client while the journaling is performed asynchronously.

Abstract: A system, method, and machine-readable storage medium for analyzing a state of a data object are provided. In some embodiments, the method includes receiving, at a storage device, a metadata request for the data object from a client. The data object is composed of a plurality of segments. The method also includes selecting a subset of the plurality of segments and obtaining a segment state for each segment of the subset. Each segment state indicates whether the respective segment is accessible via a backing store. The method further includes determining a most restrictive state of the one or more segment states and sending state information to the client in response to the metadata request, the state information being derived from the most restrictive state.

Abstract: Systems and methods are described for smoothing-out latency of IO operations processed by a distributed storage system. In some examples, latency is distributed among IO operations to more evenly spread processing of the IO operations over an IO processing interval. A target latency for IO operations for a volume of a distributed storage system is periodically calculated each sample period based on the number of IO operations to be processed during the next IO processing interval for the volume. As IO operations are received for the volume, a latency may be associated with the IO operation based on the target latency and the IO operation may be queued or synchronously processed as appropriate. Responsive to expiration of a time period that is based on at time at which a given IO operation at the head of the queue was received and the assigned latency, the given IO operation is dequeued and processed.

Abstract: One or more techniques and/or computing devices are provided for non-disruptively establishing a synchronous replication relationship between a primary volume and a secondary volume and/or for resynchronizing the primary volume and the secondary volume. For example, a baseline snapshot and one or more incremental snapshots of the primary volume are used to construct and incrementally update the secondary volume with data from the primary volume. A dirty region log is used to track modifications to the primary volume. A splitter object is used to split client write requests to the primary volume and to the secondary volume. A synchronous transfer engine session is initiated to processing incoming client write requests using the dirty region log. A cutover scanner is used to transfer dirty data from the primary volume to the secondary volume. In this way, a synchronous replication relationship is established between the primary volume and the secondary volume.

Abstract: Techniques are provided for a high availability solution (e.g., a network attached storage (NAS) solution) with address preservation during switchover. A first virtual machine is deployed into a first domain and a second virtual machine is deployed into a second domain of a computing environment. The first and second virtual machines are configured as a node pair for providing clients with access to data stored within an aggregate comprising one or more storage structures within shared storage of the computing environment. A load balancer is utilized to manage logical interfaces used by clients to access the virtual machines. During switchover, the load balancer preserves an IP address used to mount and access a data share of the aggregate used by a client.

Abstract: A system, method, and machine-readable storage medium for providing a quality of service (QoS) recommendation to a client to modify a QoS setting are provided. In some embodiments, a set of volumes of a plurality of volumes may be determined. Each volume of the set of volumes may satisfy a first QoS setting assigned to the volume and a second QoS setting assigned to the volume. The plurality of volumes may reside in a common cluster and may be accessed by the client. Additionally, a subset of the set of volumes may be determined. Each volume of the subset may satisfy an upper bound of a range based on a minimum IOPS setting of the volume. A QoS recommendation to the client to modify the first QoS setting may be transmitted for one or more volumes of the subset.

Abstract: A system can apply file placement rules to dynamically place files and directories within file system views backed by objects in an object storage system. After detection of an update to a first file system view that causes an update of an object in a storage grid, an object manager begins evaluation of file placement rules against metadata of the object. For each file placement rule that is triggered, the object manager determines identifies gateways that export the first file system view. The object manager then instructs the gateways to update their representations of the first file system view. The disclosed embodiments may be able to scale to managing hundreds of billions of files spanning thousands of file system views, especially in the presence of disconnected operation.

Abstract: Techniques are provided for backing up virtual machines from a computing environment to a storage environment. A virtual machine agent is utilized to generate a snapshot of the virtual machine. Metadata comprising a snapshot identifier of the snapshot and virtual disk information of virtual disks captured by snapshot is generated at the computing environment. The metadata is retrieved and used to create a metafile that is transferred to the storage environment within which snapshots of the virtual machine are to be stored. The snapshot is retrieved from the computing environment and is packaged into a snapshot package having a protocol format used by the storage environment. The snapshot package is transferred to the storage environment.

Abstract: Systems and methods are described for performing persistent inflight tracking of operations (Ops) within a cross-site storage solution. According to one embodiment, a method comprises maintaining state information regarding a data synchronous replication status for a first storage object of a primary storage cluster and a second storage object of a secondary storage cluster. The method includes performing persistent inflight tracking of I/O operations with a first Op log of the primary storage cluster and a second Op log of the secondary storage cluster, establishing and comparing Op ranges for the first and second Op logs, and determining a relation between the Op range of the first Op log and the Op range of the second Op log to prevent divergence of Ops in the first and second Op logs and to support parallel split of the Ops.

Abstract: A request to generate a storage system model is received. The storage system model represents at least a portion of a storage system. In response to receiving the request, a storage system interface configuration is loaded. The storage system interface configuration comprises an attribute of an entity model. The attribute corresponds to an attribute of a storage system entity of the storage system. Further in response to receiving the request, the entity model is identified as representing the storage system entity. In response to identifying the entity model as representing the storage system entity, the entity model is instantiated.