Abstract: Examples of the present disclosure can include a method. The method may include (1) obtaining, by an network function virtualization orchestrator (“NFVO”), path computation information from the integrated network, the integrated network including a virtual source and a virtual destination, (2) generating, using the path computation information, segments identifying portions of a virtual network path originating at the virtual source and terminating at the virtual destination, (3) generating, by a virtual infrastructure manager (“VIM”), a plurality of labels associated with physical links on the physical network corresponding to the identified portions of the virtual network path, and (4) determining, by the NFVO and using the plurality of labels, a network path for data transfer over the integrated network, the network path identifying virtual and physical network elements.

Abstract: Examples perform transactions across a distributed system of elements, such as nodes, computing devices, objects, and virtual machines. The elements of the distributed system maintain data (e.g, tables) which include information on transactions previously received and the source of the transactions. A first element of the distributed system transmits a transaction, the identifier (ID) of the first element, and a transaction ID to a plurality of second elements. The second elements compare the transaction ID to the maximum transaction ID associated with the first element and stored in the tables to determine whether the transaction is the most recent and should be performed, or whether the transaction has already been performed and should not be re-performed. In this manner, undo logs are not needed.

Abstract: Certain aspects herein provide a system and method for performing behavior analysis for a computing device by a computing system. In certain aspects, a method includes detecting an event occurring at the computing device at a first time, determining, based on the detecting, an event category of the event, and collecting first one or more behaviors associated with the determined event category occurring on the computing device based. The method also includes comparing the first one or more behaviors with a dataset indicating one or more expected behaviors of the computing device associated with the event. Upon determining that at least one of the first one or more behaviors corresponds to an unexpected behavior based on the comparing, the method further includes taking one or more remedial actions.

Abstract: In a computer-implemented method of data collection in a computing environment, the method including, operational data is captured within a computing environment, wherein the computing environment includes a plurality of managed components, wherein the managed components are interrelated. The operational data is dynamically filtered within the computing environment to identify event data and managed component relationship data, wherein the event data and managed component relationship data include temporal information. The event data and managed component relationship data is communicated to a remote service provider configured to perform analytics on the event data and managed component relationship data.

Abstract: Automated computational methods and systems to classify and troubleshoot problems in information technology (“IT”) systems or services provided by a distributed computing system are described. Each IT system of the distribution computing system or IT service provided by the distributed computing system has an associated key performance indicator (“KPI”) used to monitor performance of the IT system or service. When real-time KPI data violates a KPI threshold, a real-time event-type distribution is computed from event messages generated by event sources associated with the IT system or service following the threshold violation. The real-time event-type distribution is compared with historical event-type distributions recorded for the KPI data in order to identify the problem and execute remedial action to resolve the problem.

Abstract: Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (1) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane. For instance, in some embodiments, each forwarding plane connects to a machine or service node through a port that receives data messages from, or supplies data messages to, the machine or service node.

Abstract: A new approach to virtual desktop infrastructure management is described. In one example, a master virtual machine is configured to form a master image. The master virtual machine and master image are also modified to incorporate a service that performs an enrollment call to an endpoint manager associated with a virtual desktop infrastructure. One or more virtual machines are instantiated using the master image. When one of the virtual machines is booted and a user logs on, the service is invoked or executed and performs the enrollment call. The enrollment call leads to the enrollment of the virtual machine with the endpoint manager. During and after enrollment, the endpoint manager can configure the virtual machine based on one or more management policies. The management policies can be tailored in various cases, such as depending upon the credentials used to log on to the virtual machine.

Abstract: In a computer-implemented method for automatic transformation of time series data at ingestion, time series data comprising data points is received at at least one ingestion node of a time series data monitoring system, wherein the data points have an input observability format. At the at least one ingestion node, the data points the data points are transformed from the input observability format to an output observability format according to configuration rules of the time series data monitoring system. The data points having the output observability format are forwarded from the at least one ingestion node to a persistent storage device.

Abstract: In a computer-implemented method for performing alert notification on streaming textual data, streaming textual data is received. A plurality of copies of the streaming textual data is generated, wherein a first copy of the streaming textual data is transmitted to an ingestion service for persistent storage at a data plane and a second copy of the streaming textual data is transmitted to an alert evaluation service for performing alert evaluation on the streaming textual data, such that the ingestion service and the alert evaluation service are performed independently. The streaming textual data is evaluated by the alert evaluation service to detect an alert. Responsive to detecting an alert at the alert evaluation service, a notification of the alert is generated.

Abstract: Example methods and systems for routing domain computation are described. In one example, a computer system may assign multiple logical entities with respective routing domain identifiers (IDs) by processing network topology information using multiple compute nodes. In response to detecting a network topology change associated with a particular logical entity, the computer system may determine first state change information identifying a first update to first state information maintained by a first compute node; and second state change information identifying a second update to second state information maintained by a second compute node. Further, the particular logical entity with an updated routing domain ID based on the first state change information and the second state change information. The updated routing domain ID may be used in a communication between a management entity and host(s) supporting the particular logical entity.

Abstract: Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (1) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane. For instance, in some embodiments, each forwarding plane connects to a machine or service node through a port that receives data messages from, or supplies data messages to, the machine or service node.

Abstract: Some embodiments provide a novel method for collecting and reporting attributes of data flows associated with machines executing on a plurality of host computers to an analysis appliance. The analysis appliance, in some embodiments, receives definitions of keys and provides them to the host computers. In some embodiments, existing keys are modified based on the analysis. Additionally, or alternatively, new keys are provided based on the analysis. In some embodiments, the analysis appliance receives the flow group records (e.g., sets of attributes) based on the keys and the configuration data from each host computer.

Abstract: Some embodiments provide a novel method of performing health monitoring for resources associated with a global server load balancing (GSLB) system. This system is implemented by several domain name system (DNS) servers that perform DNS services for resources located at several geographically separate sites. The method identifies several different groupings of the resources. It then assigns the health monitoring of the different resource groups to different DNS servers. The method then configures each particular DNS server (1) to send health monitoring messages to the particular group of resources assigned to the particular DNS server, (2) to generate data by analyzing responses to the sent health monitoring messages, and (3) to distribute the generated data to the other DNS servers. The method in some embodiments is performed by a set of one or more controllers.

Abstract: Techniques for tiering data to a cold storage tier of a cloud object storage platform are provided. In one set of embodiments, a computer system can identify one or more old snapshots of a data set that reside in a first storage tier of the cloud object storage platform, where the one or more old snapshots are snapshots that are unlikely to be deleted from the cloud object storage platform within a period of N days. The computer system can further, for each snapshot in the one or more old snapshots: identify one or more data blocks in the snapshot that are superseded by a more recent snapshot in the one or more old snapshots; write the one or more data blocks to a second (i.e., cold) storage tier of the cloud object storage platform that has a lower storage cost than the first storage tier; and cause the one or more data blocks to be deleted from the first storage tier.

Abstract: The present disclosure is related to methods, systems, and machine-readable media for supporting deduplication in object storage using subset hashes. A plurality of hashes of a plurality of blocks of a plurality of log segments can be received from a software defined data center, wherein each block corresponds to a respective logical address. Each of the plurality of logical addresses can be associated with a respective sequentially-allocated chunk identifier in a logical map. A subset hash comprising a hash of a subset of the plurality of blocks can be determined that corresponds to a contiguous range of the plurality of logical addresses. A search of a hash map for the subset hash can be performed to determine if the subset hash is a duplicate. The subset of the plurality of blocks can be deduplicated responsive to a determination that the subset hash is a duplicate.

Abstract: The present disclosure is related to methods, systems, and machine-readable media for supporting deduplication in file storage using file chunk hashes. A hash of a chunk of a log segment can be received from a software defined data center. A chunk identifier can be associated with the hash in a hash map that stores associations between sequentially-allocated chunk identifiers and hashes. The chunk identifier can be associated with a logical address corresponding to the chunk of the log segment in a logical map that stores associations between the sequentially-allocated chunk identifiers and logical addresses. A search of the hash map can be performed to determine if the chunk is a duplicate, and the chunk can be deduplicated responsive to a determination that the chunk is a duplicate.

Abstract: Some embodiments provide a method of identifying packet latency in a software defined datacenter (SDDC) that includes a network and multiple host computers executing multiple machines. At a first host computer, the method identifies and stores (i) multiple time values associated with several packet processing operations performed on a particular packet sent by a first machine executing on the first host computer, and (ii) a time value associated with packet transmission through the SDDC network from the first host computer to a second host computer that is a destination of the particular packet. The method provides the stored time values to a set of one or more controllers to process to identify multiple latencies experienced by multiple packets processed in the SDDC.

Abstract: A system and method for assessing video quality of a video-based application inserts frame identifiers (IDs) into video content from the video-based application and recognizes the frame IDs from the video content using a text recognition neural network. Based on recognized frame IDs, a frame per second (FPS) metric of the video content is calculated. Based on the FPS metric of the video content, objective video quality of the video-based application is assessed.

Abstract: Automated methods and systems described herein are directed to identifying potential root causes of a problem in a data center. Methods and systems receipt an alert or other notification of a problem occurring in a data center and a time when the problem was noticed. A search window is created based on the time and a stream of log messages generated in the search window is converted into a time dependent metric. An anomaly detection technique is applied to the metric to determine a start time of a problem. Logging events and key phrases in the log messages are identified in the search window and presented as potential root causes of the problem. The potential root cause may then be used by system administrators and/or tenants to diagnose the problem and execute remedial measures to correct the problem.

Abstract: Some embodiments of the invention provide novel methods for performing services on data messages passing through a network connecting one or more datacenters, such as software defined datacenters (SDDCs). The method of some embodiments uses service containers executing on host computers to perform different chains (e.g., ordered sequences) of services on different data message flows. For a data message of a particular data message flow that is received or generated at a host computer, the method in some embodiments uses a service classifier executing on the host computer to identify a service chain that specifies several services to perform on the data message. For each service in the identified service chain, the service classifier identifies a service container for performing the service. The service classifier then forwards the data message to a service forwarding element to forward the data message through the service containers identified for the identified service chain.