Abstract: Methods, systems, and computer program products for thwarting a malware attack. A data storage system stores data items, some of which data items correspond to snapshots. Upon identification of a possible ransomware attack on a data item, the system identifies a version of the snapshot that is not subject to the ransomware attack and seeks to protect the data state of the system from further damage (e.g., due to performance of unauthorized operations on the version of the snapshot that is not subject to the ransomware attack) by requiring consensus from a multi-party authorization (MPA) consensus regime before carrying out requested operations over the snapshot. The MPA consensus regime operates by determining that the operation is subject to a role-based access control (RBAC) as well as a multi-party authorization (MPA) consensus protocol, and then allowing or denying execution of the requested operations based on achieving consensus from among candidate approvers.

Abstract: A method may include, based on a recovery policy associated with the primary database, creating a first snapshot of the primary database at a primary computing system, replicating the first snapshot of the primary database to a secondary computing system, wherein a backup database of the primary database is hosted on the secondary cluster, in response to the primary database being unavailable, applying the first snapshot of the primary database to the backup database, creating, according to the recovery policy associated with the primary database, a snapshot of the backup database, in response to the primary database having restored availability, creating, according to the recovery policy associated with the primary database, a second snapshot of the primary database.

Abstract: Various embodiments set forth one or more non-transitory computer-readable media storing program instructions that, when executed by one or more processors, cause the one or more processors to perform steps of determining at least one physical resource of a node in a cluster of nodes is under contention by virtual computing instances or a virtual computing instance cannot be placed on the cluster of nodes, determining a placement for one or more virtual computing instances on the cluster of nodes, each virtual computing instance having a virtual resource associated with a profile that is compatible with a profile associated with a physical resource of a node on which the virtual computing instance is placed, and generating and executing a plan to achieve the placement, the plan including at least one of migrating at least one virtual computing instance or reconfiguring a profile associated with at least one physical resource.

Abstract: Methods, systems, and computer program products for moving a container-based application from a source HCI cluster to a target HCI cluster. An HCI storage cluster data replication mechanism operates to copy data and metadata from a plurality of storage devices that constitute a storage pool of the source HCI cluster. A container-based application replication mechanism operates to copy data and metadata from an executable container that is running on a node of the source HCI cluster. Periodically (1) the state of the container-based application is saved using the container-based application replication mechanism, and (2) the state of the storage cluster data of the HCI storage cluster is saved using the HCI storage cluster data replication mechanism. The saved state of the container-based application including its application data and metadata are combined with the saved state of the storage cluster data to bring-up the container-based application at the target HCI cluster.

Abstract: Systems and methods for scalable tracking of objects to be replicated are disclosed. A method may include in a first time period, updating, by one or more processors, a data structure with metadata of a received object to be replicated, wherein the data structure includes a plurality of classifications of objects to be replicated based on when the objects were received, in a second time period, after the first time period, updating, by the one or more processors, the data structure to modify a classification of the object based on the object being received in the first time period, and replicating, by the one or more processors, the object based on the modified classification of the object.

Abstract: A system may include a memory having computer-readable instructions stored thereon and a processor of a control plane that executes the computer-readable instructions to receive a request from a tenant to update a portion of a database, determine an individual tenant identifier of the tenant, determine whether the portion of the database is associated with the individual tenant identifier or a global tenant identifier, and allow the tenant to update the portion of the database in response to determining that the portion of the database is associated with the global tenant identifier or the individual tenant identifier or restrict the tenant from updating the portion of the database in response to determining that the portion of the database is associated with neither the global tenant identifier nor the individual tenant identifier.

Abstract: In one embodiment, a system for managing communication connections in a virtualization environment includes a plurality of host machines implementing a virtualization environment, wherein each of the host machines includes a hypervisor, at least one user virtual machine (user VM), and a distributed file server that includes file server virtual machines (FSVMs) and associated local storage devices. Each FSVM and associated local storage device are local to a corresponding one of the host machines, and the FSVMs conduct I/O transactions with their associated local storage devices based on I/O requests received from the user VMs. Each of the user VMs on each host machine sends each of its representative I/O requests to an FSVM that is selected by one or more of the FSVMs for each I/O request based on a lookup table that maps a storage item referenced by the I/O request to the selected one of the FSVMs.

Abstract: A database management system receives a user request for provisioning a database, autonomously selects a datacenter for provisioning the database based at least on a first pre-defined rule, autonomously selects at least one cluster in the datacenter based at least on a second pre-defined rule, determines a network location of each of the at least one cluster, and provisions the database on each of the at least one cluster using the network location of each of the at least one cluster.

Abstract: A system and method include creating, by an Availability Group (“AG”) controller in a virtual computing system, a first AG clone from a source database. The source database is stored on a primary replica node of an AG of the virtual computing system. The system and method also include creating, by the Controller, a second AG clone from the first AG clone and storing, by the Controller, the second AG clone on a secondary replica node of the AG. The second AG clone has a size of substantially zero.

Abstract: Examples described herein are generally directed towards file server access controls, and more specifically towards a mechanism to create consistent access control lists for local users across different file servers in a distributed file server environment. In operation, a local user system SID (e.g., external SID) may be generated for a first user of a first file server. A global ID based on attributes associated with the user of the first file server may also be generated. The global ID for the user may be stored in metadata associated with an access control list (ACL) for a file accessible through the first file server. Data, including the file may be migrated to a second file server. Based on receiving an access request at the second file server associated with the user based on the external ID, the external ID for the user may be translated into the global ID, and used to determine access to the file.

Abstract: Methods, systems, and computer program products for virtualized services implemented within a containerized computing system. Multiple components are operatively interconnected to establish virtualized storage services implemented within a containerized computing system. These methods, systems, and computer program products implement flexible IP network access for storage I/O service handlers in containerized systems. After configuring a storage I/O service handler as one or more executable container components for which its cloud-based logical NIC is given an initial IP address by the containerized system, then identifying one or more reserved IP addresses that are available for use in the containerized system. To assign a new IP address at runtime, in lieu of destroying all or parts of the container components and re-initiating the container components with a newly-assigned IP address, instead, assigning, at runtime, the one or more of the reserved IP addresses to the one or more container components.

Abstract: Anomaly detection includes receiving, for one or more data points of a data set, an anomaly label indicating whether the one or more data points is an anomaly; generating, using a first machine learning model, one or more hyperparameters based on the one or more data points and the anomaly label; and training a second machine learning model to determine anomalies in the data set, wherein the training is based on the one or more hyperparameters.

Abstract: Methods, systems, and computer program products for deploying virtualized storage services. Multiple components are operatively interconnected to establish virtualized storage services implemented within a containerized computing system. These methods, systems, and computer program products implement flexible IP network access for storage I/O service handlers. Deployments comprise (1) an underlay network, the underlay network being formed of one or more routers of the cloud-provided host network and the underlay network forming an isolated namespace that is distinct from namespaces of the cloud-provided host network; (2) a container-attached storage module that is situated within the underlay network, wherein container-attached storage module operates within the isolated namespace; and (3) a network interface component that facilitates network access to the container-attached storage module via a static IP address that is configured into the network interface component.

Abstract: Methods, systems and computer program products for bringing-up a computing cluster on a public cloud infrastructure. The method includes using a multicloud management system which is configured to bring-up a computing cluster on any one of a plurality of different public cloud infrastructures to bring-up the cluster in a user's account on the public cloud infrastructure, allowing the user to directly utilize tools and features of the public cloud infrastructure and/or computer security of the user's choice.

Abstract: A patching operation on an availability group cluster having a plurality of nodes is disclosed. The patching operation is performed in a plurality of iterations, each including determining a current state of each of the plurality of nodes, selecting a next node based on the current state, and patching the next node. A secondary replica node is selected as the next node before the a primary replica node. Each secondary replica node is patched in accordance with a first priority, upon patching each of the secondary replica node, a failover target node for patching the primary replica node is selected, the failover target node is selected based on a second priority, and according to the second priority, a healthy synchronous secondary replica node of the plurality of nodes is selected as the failover target node before an unhealthy synchronous secondary replica node of the plurality of nodes.

Abstract: Computer-implemented techniques for controlling virtual machine (VM) porting activities based on dynamically-calculated virtual machine predicate values. Upon receiving a command to port a subject virtual machine from a source virtualization system environment to a target virtualization system environment (wherein the source virtualization system environment and the target virtualization system environment are different), one or more match expressions that describe time of day and resource predicates conditions, under which porting operations of the subject virtual machine are to be carried out are evaluated. Based on observance of the aforementioned time of day and resource predicates, various virtual machine porting operations are either carried out (e.g., when applicable match expressions and/or predicates evaluate to TRUE), or are temporarily suspended (e.g., when the applicable match expressions and/or predicates evaluate to FALSE).

Abstract: A technique extends a file system infrastructure of a storage system to provide a custom namespace within a pathname of a logical construct configured to invoke semantically interpretative context as a command embedded in a data access protocol request issued by a client and directed to the logical construct served by the storage system, without alteration to the data access protocol. The extension includes a “plug-in” engine of a data access protocol server executing on a network protocol stack of the storage system. The engine operates to extract a pathname from the request to determine whether the custom namespace incorporating the command is present and directed to the logical construct. If so, the engine semantically interprets the command within a context of the custom namespace to essentially convert the command to one or more predefined operations directed to the logical construct. The storage system then performs the operations and returns the results to the client.

Abstract: A method may include transmitting, by a proxy node within a subnet, one or more messages to a cluster creation service to register a plurality of nodes within the subnet with the cluster creation service, receiving, at the proxy node, from the cluster creation service, a cluster creation request identifying a group of nodes of the plurality of nodes to form a cluster, and transmitting, by the proxy node, the cluster creation request to one or more of the group of nodes.

Abstract: Methods, systems and computer program products for implementing high-availability file services in a clustered computing environment. Two or more clusters are interconnected to carry out operations for replication of file content between file servers. The file servers and their respective network links are registered with a file server witness. The file servers operate in synchrony, where each file I/O is replicated from one file server to another file server over a first set of network paths. A file server witness communicates with each file server using a second set of two or more network paths interfaced with respective file servers. The file server witness monitors the file servers to determine operational health of the file servers. Upon receipt of a file I/O request, the file I/O request is directed to one of the two file servers based at least in part on the determined operational health.

Abstract: The present disclosure describes techniques used in systems, methods, and in computer program products to perform incremental hibernate and resume of bare metal clusters. A replication process can generate full/incremental snapshots at the cluster level and at a resource level of the processes of the cluster. In the even that a user instructs the cluster to hibernate some or all processes of the cluster, the process can capture an incremental snapshot of the corresponding resources far more quickly than would be required to generate full snapshots for those resources. Likewise, system configuration information can be captured to enable the underlying infrastructure of the cluster to be restored in the future. In some embodiments, the approach provided herein also implements an instant restore feature.