Abstract: Automated processes and systems troubleshoot and optimize performance of applications running in distributed computing systems. An automated computer-implemented processes train an inference model for an application based on metrics associated with the application and a key performance indicator (“KPI”) of the application. When a run-time performance problem is detected in run-time KPI values of KPI, the trained inference model is applied to run-time metrics and run-time KPI values to identify relevant run-time metrics that can be used to identify the root cause of the performance problem. The root cause of the performance problem can be used to generate a recommendation for correcting the performance problem. An alert identifying the root cause of the performance problem and the recommendation for correcting the performance problem are displayed on an interface of a display, thereby enabling correction of the performance problem and optimization of the application.

Abstract: Examples described herein include systems and methods for brokerless reliable totally ordered many-to-many inter-process communication on a single node. A messaging protocol is provided that utilizes shared memory for one of the control plane and data plane, and multicast for the other plane. Readers and writers can store either control messages or message data in the shared memory, including in a ring buffer. Write access to portions of the shared memory can be controlled by a robust futex, which includes a locking mechanism that is crash recoverable. In general, the writers and readers can control the pace of communications and the crash of any process does not crash the overall messaging on the node.

Abstract: Some embodiments provide a method for associating data message flows from applications executing on a host computer with network interfaces of the computer. The method of some embodiments identifies a set of applications operating on a machine executing on the host computer, identifies candidate teaming policies for associating each identified application with a subset of one or more interfaces, and generates a report to display the identified candidate teaming policies per application to a user. In response to user input selecting a first teaming policy for a first application, the method generates a rule, and distributes the rule, to the host computer to associate the first application with a first subset of the network interfaces specified by the first teaming policy.

Abstract: A first server can generate user profiles and receive requests from user devices for enrollment in a first server-managed system that includes user groups. The first server can provide a unique key to a user device during an enrolment process based on a user group the user device is assigned to. The first server can include an enrollment notification for the user device in a first notification transmitted to a messaging service. The messaging service can transmit a second notification to the user device, and the user device can request a user profile from a second server based on second server access information included in the second notification. The second server can use the unique key to access user profile information which it transmits to the user device based on the request. The user device can access the user profile from the profile information using the unique key.

Abstract: Some embodiments provide a method for performing radio access network (RAN) functions in a cloud at a medium access control (MAC) scheduler application that executes on a machine deployed on a host computer in the cloud. The method receives data, via a RAN intelligent controller (RIC), from a first RAN component. The method uses the received data to generate a MAC scheduling output. The method provides the MAC scheduling output to a second RAN component via the RIC.

Abstract: Techniques are described for auditing print content during printer redirection in a virtual desktop. The ability to audit redirected print content allows an organization to pre-define certain sensitive data and to track whether print redirection requests in the virtual desktop environment contain any such sensitive data. If such sensitive data is contained in a printer redirection request, a file is generated containing information about the sensitive data, as well as a watermark that encodes information about the printer redirection request, such the user identifier of the user who initiated the print request and a timestamp of when the print request occurred. The generated file is transmitted to one or more registered recipients.

Abstract: Configuring network packet event related execution is disclosed, including: receiving a set of virtual service configuration information associated with a specified virtual service; using the set of virtual service configuration information to generate a set of event context information corresponding to the virtual service; and storing the set of event context information in a shared memory. Executing scripts related to a network packet event is disclosed, including: determining, using a service engine data path (SEDP) executing at the core, an event associated with a received network packet directed to a virtual service; determining a set of scripts to be executed corresponding to the event; generating a child interpreter context corresponding to the parent interpreter context corresponding to the virtual service; and using the child interpreter context to execute the set of scripts in the core specific memory corresponding to the core.

Abstract: Systems and methods are described for establishing trust between two devices for secure peer-to-peer communication. In an example, a first and a second device can each possess a digital signature issued by the same certificate authority and a hash function issued by the same trusted entity. The devices can exchange public keys that include their respective digital signatures. The second device can verify the first device's digital signature, encrypt an encryption key with the second device's public key, hash the encryption key using its hash function, and encrypt the hash using its private key. The second device can send the encrypted hash and encryption key to the first device. The first device can verify the second device's digital signature, decrypt the encryption key, and decrypt the encrypted hash. The first device can hash the encryption key using its hashing function and compare the two hashes to verify the second device.

Abstract: Disclosed are various approaches for workflow service email integration. In some examples, an email application executed on a client device receives an email message that includes a workflow micro application. The workflow micro application has a workflow information component, and evaluation component, and a workflow actions component. The evaluation component identifies a presence or an absence of a management software development kit (SDK) on the client device. The email application renders a user interface that shows or hides a workflow actions interface area based on the presence or absence of the management SDK.

Abstract: Examples of scheduled and on-demand volume encryption suspension are described. In some examples, volume encryption is to be suspended for a client device. A suspension limit is identified for a volume encryption suspension for the client device. A suspend encryption command is generated to include instructions for the client device to apply the volume encryption suspension according to the suspension limit. The suspend encryption command is transmitted to the client device for execution.

Abstract: Some embodiments of the invention provide a method for connecting deployed machines in a set of one or more software-defined datacenters (SDDCs) to a virtual private cloud (VPC) in an availability zone (AZ). The method deploys network plugin agents (e.g. listening agents) on multiple host computers and configures the network plugin agents to receive notifications of events related to the deployment of network elements from a set of compute deployment agents executing on the particular deployed network plugin agent's host computer. The method, in some embodiments, is performed by a network manager that receives notifications from the deployed network plugin agents regarding events relating to the deployed machines and, in response to the received notifications, configures network elements to connect one or more sets of the deployed machines.

Abstract: Capacity forecasting may be performed for distributed storage resources in a virtualized computing environment. Historical data indicative of usage of the storage resources is transformed into a privacy-preserving format and is preprocessed to remove outliers, to fill in missing values, and to perform normalization. The preprocessed historical data is inputted into a machine-learning model, which applies a piecewise regression to the historical data to generate a prediction output.

Abstract: Intelligent capacity planning is provided for storage in a hyperconverged infrastructure environment. The storage may be a logical storage unit that is supported by storage space of a plurality of hardware disks in a virtualized computing environment. Failure predictions can be obtained for each individual hardware disk, and a failure prediction for a number of hardware disk in a hardware disk set can also be obtained. A failure prediction and/or a reduced availability prediction for the logical storage unit can be generated based at least on a configuration state of the logical storage unit, a prediction for one or more hardware disks of the logical storage unit, and a prediction time. Predictions based on what-if operations are also able to be generated.

Abstract: The current document is directed to methods and systems that automatically instantiate complex distributed applications by deploying distributed-application instances across the computational resources of one or more distributed computer systems and that automatically manage instantiated distributed applications. The current document discloses decentralized, distributed automated methods and systems that instantiate and manage distributed applications using multiple agents installed within the computational resources of one or more distributed computer systems. The agents exchange distributed-application instances among themselves in order to locally optimize the set of distributed-application instances that they each manage. In addition, agents organize themselves into groups with leader agents to facilitate efficient, decentralized exchange of control information acquired by employing machine-learning methods.

Abstract: The present invention is a highly available system comprising a system to send a plurality of bootstrap requests, at least one cloud proxy fit to receive the plurality of bootstrap requests, wherein each instance of the at least one cloud proxy is coupled with an adapter, and at least one host fit to communicate with one of the at least one cloud proxy.

Abstract: Intelligent capacity planning is provided for storage in a hyperconverged infrastructure environment. The storage may be a logical storage unit that is supported by storage space of a plurality of hardware disks in a virtualized computing environment. Failure predictions can be obtained for each individual hardware disk, and a failure prediction for a number of hardware disk in a hardware disk set can also be obtained. A failure prediction and/or a reduced availability prediction for the logical storage unit can be generated based at least on a configuration state of the logical storage unit, a prediction for one or more hardware disks of the logical storage unit, and a prediction time. Predictions based on what-if operations are also able to be generated.

Abstract: A framework is provided that assigns a digital certificate to each VM-based control plane element and computing node (i.e., worker VM) of a workload orchestration platform implemented in a virtualized environment, where the digital certificate is signed by a trusted entity and provides cryptographic proof that the control plane element/worker VM has been successfully attested by that trusted entity using hardware-based attestation. Each control plane element/worker VM is configured to verify the digital certificates of other platform components prior to communicating with those components. With these digital certificates in place, when an end-user submits to the platform's front-end control plane element a new workload for deployment, the end-user can verify the digital certificate of the front-end control plane element in order to be assured that the workload will be deployed and executed by the platform in a secure manner.

Abstract: Some embodiments provide a method for forwarding data messages between edge nodes that perform stateful processing on flows between a logical network and an external network. At a particular edge node, the method receives a data message belonging to a flow. The edge nodes use a deterministic algorithm to select one of the edge nodes to perform processing for each flow. The method identifies a first edge node to perform processing for the flow in a previous configuration and a second edge node to perform processing for the flow in a new configuration according to the algorithm. When the first and second edge nodes are different, the method uses a probabilistic filter and a stateful connection tracker to determine whether the flow existed prior to a particular time. When the flow did not exist prior to that time, the method selects the second edge node for the received data message.

Abstract: A plug-in based framework provides high availability (HA), including fault tolerance, in a distributed system, such as provided by a virtualized computing environment. The framework uses blueprints that define entities to be monitored, failure conditions, failover actions, restoration actions, and other aspects associated with HA. Microservices execute the blueprints, and a load balancer may balance the execution of the blueprints amongst microservices.

Abstract: A method for deleting one or more snapshots using micro-batch processing is provided. The method includes receiving a request to delete the one or more snapshots, identifying one or more middle map extents exclusively owned by the one or more snapshots requested to be deleted, wherein metadata for the one or more snapshots is stored in one or more logical maps having logical map extents mapping logical block addresses (LBAs) to middle block addresses (MBAs) and a middle map having middle map extents mapping MBAs to physical block addresses (PBAs) of physical locations where data blocks are written, adding MBAs of the identified one or more middle map extents in a batch, determining a first micro-batch including a first subset of the MBAs in the batch, the first subset of MBAs being MBAs less than a first upper bound MBA, and using a first transaction to delete the middle map extents corresponding to the first subset of MBAs included in the first micro-batch.