Abstract: Some embodiments of the invention provide methods for performing root cause analysis for non-deterministic anomalies in a datacenter. For instance, the method of some embodiments identifies a root cause for degradation in performance of one or more components in a network of the datacenter. This method collects and generates resource consumption data regarding resources consumed by a set of components in this network. The method performs a first analysis on the collected and/or generated data to identify an instance in time when one or more components, while still operational, are possibly suffering from performance degradation. The method then performs a second analysis on the collected and/or generated data associated with the identified time instance to identify a root cause of a performance degradation of at least one component in the network.

Abstract: A network system that uses a cluster of edge nodes to send and receive multicast traffic is provided. The network system is a network virtualization environment that includes one or more distributed routers, each distributed router implemented by virtualization software running on one or more host machines. The network system also includes a cluster of edge nodes for sending data from the one or more distributed routers to one or more uplink/upstream physical routers outside of a datacenter and for receiving data from the physical routers to the distributed routers. One of the edge nodes is a designated edge node that queries for membership information for one or more multicast groups to be received by at least two edge nodes of the cluster of edge nodes. The cluster of edge nodes forwards multicast traffic to and from the distributed routers according to the received membership information.

Abstract: Techniques for providing topic-based data routing in a publish-subscribe messaging environment are disclosed. In one example, a system supported by hardware in a publish-subscribe messaging environment may include a message broker to receive topic metadata at a first instance according to a first interval into a predefined fixed topic. Further, the system may include a topic list subscriber that subscribes to the predefined fixed topic and obtains a list of topics from the message broker. Furthermore, the system may include a subscription manager to assign topics in the list of topics to a set of subscribers according to a criteria. In one example, the message broker may route data corresponding to the topics to the set of subscribers in accordance with the topics assigned to the set of subscribers.

Abstract: An example apparatus includes a dependency graph generator to generate a dependency graph based on a resource request file specifying a first resource and a second resource to deploy to a resource-based service, the dependency graph representative of the first resource being dependent on a second resource, a verification controller to generate a status indicator after a determination that a time-based ordering of a first request relative to a second request satisfies the dependency graph, and a resource controller to cause transmission of the first request and the second request to the resource-based service based on the dependency graph, and, after determining that the time-based ordering of the first request relative to the second request satisfies the dependency graph, cause transmission of the status indicator to a user device.

Abstract: In one set of embodiments, confidential data needed by a workload component running within a worker VM can be placed on an encrypted virtual disk that is attached to the worker VM and hardware-based attestation can be used to validate the worker VM's software and isolate its guest memory from its hypervisor. Upon successful completion of this attestation process, a data decryption key can be delivered to the worker VM via a secure channel established via the attestation, such that the hypervisor cannot read or alter the key. The worker VM can then decrypt the contents of the encrypted virtual disk using the data decryption key, thereby granting the workload component access to the confidential data.

Abstract: Methods, apparatus, systems and articles of manufacture to establish a data pipeline between cloud computing platforms. An apparatus includes at least one memory, machine readable instructions in the apparatus, and processor circuitry to execute the machine readable instructions to at least extract a data producer name from data, the data to be provided from a data producer to a data consumer, identify a buffer identifier based on a mapping of the data producer name to the buffer identifier, cause transmission of the data to a buffer associated with the buffer identifier, and cause transmission of the data from the buffer to the data consumer based on an association between the buffer identifier and a data consumer name, the data consumer name corresponding to the data consumer.

Abstract: Methods, apparatus, systems and articles of manufacture to provide a custom installable open virtualization application file for on-premise installation via the cloud are disclosed. Example instructions cause one or more processors to determine a sizing factor based on a response from a user device; determine customized resource information for an agent in a private cloud network using an inventory count algorithm based on the sizing factor; modify an open virtualization appliance (OVA) file to include the customized resource information, the OVA file being deployed in a public cloud network; and transmit an indication to a location of the modified OVA file to the user device, the location of the modified OVA file being the same location as the OVA file.

Abstract: Some embodiments of the invention provide novel methods for using probabilistic filters to keep track of data message flows that are processed at an element (e.g., forwarding element or middlebox service element) of a network. In some embodiments, the method iteratively switches between two probabilistic filters as the active and backup filters as a way of maintaining and refreshing its active probabilistic filter without the need for maintaining time values for removing outdated records from its active filter.

Abstract: The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems.

Abstract: The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems.

Abstract: Techniques for enabling efficient guest OS access to PCIe configuration space are provided. In one set of embodiments, a hypervisor can reserve a single host physical memory page in the host physical memory of a host system and can populate the single host physical memory page with a value indicating non-presence of PCIe device functions. The hypervisor can then create, for each guest physical memory page in a guest physical memory of a virtual machine (VM) corresponding to a PCIe configuration space of an absent PCIe device function in the VM, a mapping in the hypervisor's second-level page tables that maps the guest physical memory page to the single host physical memory page.

Abstract: An enhanced robust input protocol for secure multi-party computation (MPC) via pseudorandom secret sharing is provided. With this enhanced protocol, the servers that participate in MPC can generate and send a single random sharing [R] to a client with k inputs (rather than a separate random sharing per input), and the client can derive k pseudorandom sharings from [R] without any further server interactions.

Abstract: Some embodiments provide a network management system for managing a logical network that spans multiple physical sites. The network management system includes a global network manager for receiving global logical network configuration data for the multiple physical sites. The network management system includes, at each of the physical sites, (i) a local network manager for receiving a logical network configuration for the physical site from the global network manager and (ii) a set of central controllers for distributing logical network configuration data to computing devices that implement the logical network at the physical site.

Abstract: In some embodiments, a method instantiates a proxy that stores first state information for first workloads running on a first computing device. The first computing device receives a migrated workload from a second computing device and second state information for a session associated with the migrated workload. The second state information is generated by a proxy on the second computing device that processed one or more packets for the migrated workload on the second computing device. The method stories the second state information for the proxy on the first computing device and resumes the session associated with the migrated workload using the proxy on the first computing device.

Abstract: Some embodiments provide a method for operating a physical server in a network. The method stores multiple copies of a virtual machine (VM) image at a network-accessible storage. The method uses a first copy of the VM image as a virtual disk to execute a VM on a hypervisor of a first physical computing device. The method uses a second copy of the VM image as a virtual disk accessible via a smart network interface controller (NIC) of a second physical computing device to execute an operating system of the second physical computing device.

Abstract: Described herein are systems and methods for allocating to tunnel endpoints to virtual machines on a host. In one example, a host identifies when a new virtual machine is coupled to a virtual switch and determines a tenant associated with the new virtual machine. The host further determines whether a tunnel endpoint is allocated to the tenant and, when a tunnel endpoint has not been allocated, allocates a new tunnel endpoint to the tenant and maps the new virtual machine to the new tunnel endpoint.

Abstract: Some embodiments of the invention provide a method for WAN (wide area network) optimization for a WAN that connects multiple sites, each of which has at least one router. At a gateway router deployed to a public cloud, the method receives from at least two routers at least two sites, multiple data streams destined for a particular centralized datacenter. The method performs a WAN optimization operation to aggregate the multiple streams into one outbound stream that is WAN optimized for forwarding to the particular centralized datacenter. The method then forwards the WAN-optimized data stream to the particular centralized datacenter.

Abstract: In a computer-implemented method for handling of an index update, time series data is received at an ingestion node of a time series data monitoring system. An index update is determined based on the time series data. The index update is stored to an index database of the time series data monitoring system. The index update is forward to a plurality of query nodes of the time series data monitoring system.

Abstract: Some embodiments provide a method of migrating a first software defined (SD) network managed by a first network manager to a second SD network managed by a second network manager. The method of some embodiments is performed by a third network manager that provides an interface that allows a set of users to specify and review logical network components, which the first and second network managers can then respectively deploy in the first and second SD networks. The third network manager in some embodiments identifies for a migration manager a first group of two or more logical network components that the third network manager previously specified for the first network manager to deploy in the first SD network.

Abstract: Some embodiments provide a method for implementing a logical router that spans multiple datacenters. The method receives a configuration for a set of logical switches and a logical router (LR) that (i) handles data traffic between data compute nodes (DCNs) connected to the logical switches and endpoints not connected to the set of logical switches and (ii) performs stateful services on the traffic. The DCNs include at least one DCN operating in each datacenter. For each datacenter, the method defines a centralized routing component (SR) for the LR for handling the traffic between the DCNs in the datacenter and the endpoints not connected to the set of logical switches. The method designates one of the SRs as a primary SR and the other SRs as secondary SRs. The secondary SRs forward traffic, received from DCNs in their respective datacenters and for which stateful services are required, to the primary SR.