Abstract: One or more computer systems, a carrier medium, and a method are provided for backing up virtual machines. The backup may occur, e.g., to a backup medium or to a disaster recovery site, in various embodiments. In one embodiment, an apparatus includes a computer system configured to execute at least a first virtual machine, wherein the computer system is configured to: (i) capture a state of the first virtual machine, the state corresponding to a point in time in the execution of the first virtual machine; and (ii) copy at least a portion of the state to a destination separate from a storage device to which the first virtual machine is suspendable. A carrier medium may include instructions which, when executed, cause the above operation on the computer system. The method may comprise the above highlighted operations.

Abstract: System and method for object-centric Storage Area Network (SAN) zoning visualization. Embodiments may provide graphical and/or textual displays and reporting of logical and/or physical zone and zone alias information for SAN objects to users or administrators of a SAN. SAN objects may include any logically or physically zonable SAN component. Embodiments may graphically and/or textually present logical and/or physical zoning information for any SAN object via real-time displays and/or reporting in response to selecting the object. All of the zones, and zone aliases, if any, of which a SAN object is a logical and/or physical member may be determined and displayed, along with other relevant information including the mechanisms by which the SAN object is logically zoned. Embodiments may provide mechanisms through which a user may navigate through the displayed zoning information to view zoning information for other SAN objects and/or zone-centric information for the zones and zone aliases.

Abstract: A method and system for externally managed file versions. In shared storage environments file versions may be managed utilizing sparse data objects in storage devices. A file version may comprise a chain of one or more sparse data objects, where each object may represent changes compared to the data in other objects of the chain. New, empty sparse data objects may be attached to existing object chains to create new file versions. When providing file version metadata, a metadata server may provide information for the entire object chain. Write permission may be granted only for the front-most object in a chain, while all other objects in the chain may be write-protected. A storage device may expose the presence of holes in sparse data objects to help locate information in the object chain.

Abstract: Systems, methods, apparatus and software can provide the capability of grouping related files together so as to optimize placement of the files on the physical media. Consequently, certain system operations (e.g., backup, defragmentation and the like) can be performed on the group of files, as opposed to a single file or the entire filesystem.

Abstract: A system, method, and computer-accessible medium for searching in a server management system are disclosed. One or more search terms are determined. A search is performed for object definitions which match the search terms, thereby determining one or more matching objects corresponding to the object definitions which match the one or more search terms. The matching objects are reported.

Abstract: A system and method are disclosed for routing data packets for network flow analysis by a multi-processor system. A data packet comprising data sufficient to identify a network connection with which the data packet is associated is received. A hash value is calculated based on the data sufficient to identify the network connection with which the data packet is associated. The data packet is assigned, based on the hash value, to one of the plurality of processors for analysis.

Abstract: A method, computer program product and system that establishes and maintains a business continuity policy in a server consolidation environment. Business continuity is ensured by enabling high availability of applications. When an application is started, restarted upon failure, or moved due to an overload situation, a system is selected best fulfilling the requirements for running the application. These requirements can include application requirements, such as an amount of available capacity to handle the load that will be placed on the system by the application. These requirements can further include system requirements, such as honoring a system limit of a number of applications that can be run on a particular system. Respective priorities of applications can be used to determine whether a lower-priority application can be moved to free resources for running a higher-priority application.

Abstract: A system for efficient backups using dynamically shared storage pools in peer-to-peer networks comprises one or more processors and memory coupled to the processors. The memory stores instructions executable by the processors to implement a backup manager configured to dynamically subdivide a storage pool into one or more portions of storage currently designated for local backup data and one or more portions of storage currently designated for peer-to-peer (P2P) backup data. In response to local backup data received from a backup client, the backup manager may store the local backup data in a portion of the storage pool that is currently designated for local backup data. The backup manager may then generate a P2P version of the local backup data, e.g., by encrypting and/or redundancy encoding the local backup data, and transmit parts of the P2P version to each of one or more peer devices in the P2P network.

Abstract: Network evasion and misinformation detection are disclosed. Techniques are provided for network security, including determining whether a particular packet, segment, frame, or other data encapsulation has been retransmitted. By detecting and tracking retransmits, the packet may be compared to the original packet to determine whether an attack exists. By evaluating the original data stream and a copy of the original data stream modified with the retransmitted packet, an evasion or misinformation attempt may be detected, invoking pattern or signature matching to determine whether an attack is attempted against a target host.

Abstract: Virtual penetration testing using threat analysis is disclosed. Threat analysis may be achieved by evaluating attack paths and chain reactions of compromised assets created by threats, threat agents, or threat mechanisms. A threat agent having an existing access level is identified. The existing access level is used to analyze an attack path between the threat agent and an asset. The existing access level is updated if the analysis of the attack path between the threat agent and the asset indicates that an attack along the path would be successful.

Abstract: An antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. A file scanning module (316) can scan files to determine whether the files are infected by viruses. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The file scanning module (316) scans the files in the set.

Abstract: A system for continuous protection of working set data comprises a primary host (such as a laptop or a desktop), a peripheral memory device (such as a flash memory device or “memory stick”) and a working set protection manager. The working set protection manager is configured to detect an operation performed on a data object at the primary host and store a record associated with the operation at the peripheral memory device. In addition, in response to a detection of a backup operation from the primary host to a secondary backup device, the working set protection manager is configured to mark the record for deletion from the peripheral memory device.

Abstract: A method, system, and apparatus that provide an equivalent of persistent frozen image snapshots through the use of a time-addressable storage object, such as a time-indexed storage volume, are presented. These virtual snapshot images are presented to a system in a manner such that the image is not persistent and therefore (i) do not take up additional storage resources, and (ii) reduce the amount of volume management overhead that must be maintained since information about the snapshot can be discarded when the snapshot is no longer needed.

Abstract: A system, method, and medium provide communication between a volume server and a volume owner in a distributed storage management system. A volume server may manage configuration information for a particular volume of storage. A volume owner may manage input/output (I/O) for the volume. The volume server may lease the configuration information to the volume owner using a communications protocol. The communications protocol comprises a plurality of operations for management of the lease. The volume owner may use the configuration information to manage the I/O for the volume.

Abstract: A technique for protecting a computer system against malware involves distributing anti-malware data across multiple computing resources. When a local machine detects a malware instance, the local machine may then query a network resource for anti-malware data needed to at least one of identify and remediate the malware instance. The malware instance is then remediated using the anti-malware data from the network resource.

Abstract: The inventions relate generally to computer systems having facilities for providing virtual portions of file systems and configuration settings to applications. More particularly, the inventions relate to computer systems that provide a layer organization for files and configuration settings that can be overlaid on top of an operating system. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Abstract: Some computer operating systems do not permit application programs to perform certain tasks. If there is a desire to perform a forbidden task, a virtual partition (228) is created (610) in a storage device (108), such as a hard disk drive, associated with the computer system (100). The virtual partition (228) is stored as a file within the file system of the storage device (108). Operating system files (414) are installed in the virtual partition (228), and the storage device (108) is configured (616) to boot the computer system (100) using the operating system in the virtual partition. When the task is complete, the computer system (100) is configured to boot using the operating system other than the one in the virtual partition.

Abstract: Various embodiments of volume replication are disclosed. A request may be received to replicate a storage layout of a first storage system to a second storage system. A storage layout (e.g., configuration) of the first storage system may be determined, and one or more storage options of the second storage system may be determined. The storage options of the second storage system may include one or more storage devices available to the second storage system. A storage layout for the second storage system may be determined based on the storage options of the second storage system and the storage layout of the first storage system. Determining the storage layout of the second storage system may be based on the user input. The determined storage layout for the second storage system may be implemented, and data from the first storage system may be replicated onto the second storage system.

Abstract: A method, system, computer system, and computer-readable medium that enable a copy of data to be converted from a full-data snapshot to a space-saving snapshot, or vice versa, while retaining all the contents of the snapshot. Full-data snapshots can be used for efficient read operations and off-host processing operations. Space-saving snapshots can be used to store multiple copies of primary data in a minimum amount of storage space without consuming unnecessary storage space to store duplicate copies of data that are not changing. The ability to convert between full-data and space-saving snapshots enables organizational storage, backup, and recovery needs to be met using the best type of snapshot for a given operation.

Abstract: A method includes determining that an entire update name list has been attempted and obtaining a verified IP address from a success history file. The success history file includes verified IP addresses of computer systems from which update information has previously been successfully obtained. The method further includes obtaining update information from a computer system located at the verified IP address.