Abstract: Methods and systems assist data center customer to plan virtual data center (“VDC”) configurations, create purchase recommendations to achieve either an expansion or contraction of a VDC, and optimize the data center cost. Methods generate recommendations on lower cost combinations of virtual machine (“VM”) guest OS licenses, server computer hardware and VM software to optimize the costs are generated, generate data center customer plans for additional VMs with Quest OS for a projected period of time, provide recommendations on lower cost combination of guest OS licenses, server hardware, and VM software to optimize the cost. Methods also report any underutilized licensed servers and provide recommendations for cost savings when volume licenses can be replaced by instance based software licenses. Methods may generate VM placement recommendations to data center customers while the customers attempt to manually migrate VMs to different server computers.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for resynchronizing data in a storage system. One of the methods includes determining that a particular disk of a capacity object of a storage system is out-of-sync and that a primary disk is unavailable; and for each segment of one or more segments of the capacity object: generating a first version of the column of the segment corresponding to the unavailable primary disk; determining whether the data integrity token in the column summary of the generated first version is valid; and in response to determining that the data integrity token is valid, resynchronizing the column of the segment corresponding to the particular disk using i) the primary columns of the segment corresponding to each available primary disk and ii) the first version of the column of the segment corresponding to the unavailable primary disk.

Abstract: Techniques for replicating virtual machine data is provided. A plurality of compute nodes running on a primary cluster determine the amount of virtual machine data cached within each compute node. Based on the amount of virtual machine data for a particular virtual machine, a particular compute node is assigned to replicate the data to a secondary cluster. The amount of particular virtual machine data copied to the secondary cluster is based on updated virtual machine data that belongs to a particular state of the virtual machine. The destination of the particular virtual machine data is based on available cache space and prior replication statistics for target compute nodes on the secondary cluster.

Abstract: In an embodiment, a computer-implemented method for highly-scalable, in-network multicasting of statistics data is disclosed. In an embodiment, a method comprises: receiving, from an underlay controller, a match-and-action table that is indexed using one or more multicast (“MC”) group identifiers and includes one or more special MC headers; detecting a packet carrying statistics data; determining whether the packet includes an MC group identifier; in response to determining that the packet includes the MC group identifier: using the MC group identifier, retrieving a special MC header, of the one or more special MC headers, from the match-and-action table; generating an encapsulated packet by encapsulating the packet with the special MC header; and providing the encapsulated packet to an interface controller for transmitting the encapsulated packet to one or more physical switches.

Abstract: The current document is directed to methods and systems that employ network metrics collected by distributed-computer-system metrics-collection services to determine a service-call-based topology for distributed service-oriented applications. In a described implementation, network metrics are collected over a number of network-metric monitoring periods. Independent component analysis is used to extract, from the collected network metrics, signals corresponding to sequences of service calls initiated by calls to the application-programming interface of a distributed service-oriented application. The signals, in combination with call traces obtained from a distributed-services call-tracing utility or service, are then used to construct representations of distributed-service-oriented-application topologies. The distributed-service-oriented-application topologies provide a basis for any additional types of distributed-computer-system functionalities, utilities, and facilities.

Abstract: Some embodiments of the invention provide a novel architecture for providing context-aware middlebox services at the edge of a physical datacenter. In some embodiments, the middlebox service engines run in an edge host (e.g., an NSX Edge) that provides routing services and connectivity to external networks (e.g., networks external to an NSX-T deployment). Some embodiments use a novel architecture for capturing contextual attributes on host computers that execute one or more machines and providing the captured contextual attributes to context-aware middlebox service engines providing the context-aware middlebox services. In some embodiments, a context header insertion processor uses contextual attributes to generate a header including data regarding the contextual attributes (a “context header”) that is used to encapsulate a data message that is processed by the SFE and sent to the context-aware middlebox service engine.

Abstract: An example method of migrating a firewall policy between a first virtual data center and a second virtual data center includes: generating a static firewall from a firewall document at a first firewall server in the first virtual data center, the firewall document defining polices applied to groups of objects in the first virtual data center, the static firewall including firewall rule tuples; sending the static firewall from the first firewall server to a second firewall server in the second virtual data center; migrating a plurality of virtual machines (VMs) from the first virtual data center to the second virtual data center; and importing the firewall document from the first firewall server to the second firewall server by mapping the policies of the first firewall to groups of objects in an inventory of the second virtual data center.

Abstract: A process monitoring methodology is disclosed. In a computer-implemented method, a selection of a process to be monitored is received. The process is to be at least partially performed using a component of a computing environment. An expected operating parameter of the process is determined. The process is also monitored to determine an actual operating parameter of the process. The actual operating parameter of the process is compared with the expected operating parameter of the process to generate a comparison result. An operation is then automatically performed based upon the comparison result.

Abstract: Disclosed are various examples of device and management service integration using a device connector service that acts as a proxy. The device connector service can receive a device identifier for a device, and an enterprise identifier, and generate a management unique device identifier (UDID) using these values. The management UDID can be used in an enrollment request that enrolls the device with the management service. Device data including a device configuration can be received from the management service, and the device configuration can be relayed to a device connector client to apply the device configuration to the device.

Abstract: The disclosure herein describes enhancing data durability of a base component using multiple delta components. A first and second delta component are generated based on the base component becoming unavailable. A write operation targeted for the base component is routed to the first delta component and to the second delta component. Based on routing the write operation targeted for the base component to the first delta component and to the second delta component, a bit associated with a data block affected by the write operation is changed in each of the tracking bitmaps of the first and second delta components. Based on detecting the base component becoming available, one delta component of the first and second delta components is selected, and the data block affected by the routed write operation is synchronized from the selected delta component to the base component. Later, the first and second delta components are removed.

Abstract: Methods and systems described herein are directed to troubleshooting anomalous behavior in a data center. Anomalous behavior in an object of a data center, such as a computational resource, an application, or a virtual machine (“VM”), may be related to the behavior of other objects at different hierarchies of the data center. Methods and systems provide a graphical user interface that enables a user to select a selected metric associated with an object of the data center experiencing a performance problem. Unexpected metrics of an object topology of the data center that correspond to the performance problem are identified. A recommendation for executing remedial measures to correct the performance problem is generated based on the unexpected metrics.

Abstract: An example method of packet forwarding for a packet set in a network device includes: selecting a first bit pattern of multiple adjacent bits from a bit string that represents an input packet set; selecting a second bit pattern of multiple adjacent bits from a first node of a data structure that implements a prefix-compressed decision diagram representing a first class of packets; performing a comparison of the first bit pattern to the second bit pattern; generating an output packet set, which is a subset of the input packet set, in response to the first bit pattern matching the second bit pattern; and applying a network forwarding action to the output packet set, the network forwarding action associated with the prefix-compressed decision diagram and dictating packet forwarding behavior of the network device with respect to the output packet set.

Abstract: The current document is directed to automated application-release-management facilities that, in a described implementation, coordinate continuous development and release of cloud-computing applications. The application-release-management process is specified, in the described implementation, by application-release-management pipelines, each pipeline comprising one or more stages, with each stage comprising one or more tasks. The currently described methods and systems allow resources to be shared among multiple, interdependent release pipelines and allow access to shared resources to be controlled.

Abstract: System and method for executing a security operation for microservices/serverless function of a microservices-based/serverless application running on a physical infrastructure use a central security controller to execute the security operation for different microservices/serverless functions of the microservices-based/serverless application. Requests for the security operation are transmitted to the central security controller when communications are received at the different microservices/serverless functions of the microservices-based/serverless application. Results of the security operation are then received from the central security controller at the different microservices/serverless functions of the microservices-based/serverless application. Based on the results of the security operation, a task associated with the communications is executed at the different microservices/serverless functions.

Abstract: Examples described herein include systems and methods for controlling access to a server, such as an email server or a gateway, in situations where the identity of the requesting device is unknown or where the user device accesses the server using an unknown or unmanaged application. In one example, the system can utilize a user authentication credential included in the request to identify other devices belonging to the user that happen to be enrolled with the system. An out-of-band message can be sent to those enrolled devices, requesting confirmation from the user and, in conjunction with an authentication token, allowing the system to trust the previously unknown device. In the example of an unmanaged application attempting to access an email server, the system can confirm compliance of the requesting device and issue an authentication token that, along with an appropriate command sent to the email server, provides access.

Abstract: Disclosed are various examples for threat detection and security for edge devices in communication with Internet-of-Things (IoT) devices. In one example, a profile is associated with a virtual machine of a gateway device. The profile includes an expected behavior for the virtual machine. The virtual machine is executed by a hypervisor of the gateway device. An actual behavior for the virtual machine is determined. A remedial action is performed. The remedial action is based on an anomaly between the expected behavior and the actual behavior.

Abstract: In a computer-implemented method for using a nested host manager in a hyper converged infrastructure to streamline the upgrade process for one or more hosts in a workload domain, a first workload domain having one or more hosts is chosen, and at least one host of the one or more hosts is designated for an upgrade. The resource allotment of the at least one host is evaluated and a nested host having a comparable resource allotment is selected and provided in a second workload domain. Communication is redirected from the at least one host to the nested host. The at least one host is placed in a maintenance mode, updated, and returned to an operational mode.

Abstract: Methods and systems assist data center customer to plan virtual data center (“VDC”) configurations, create purchase recommendations to achieve either an expansion or contraction of a VDC, and optimize the data center cost. Methods generate recommendations on lower cost combinations of virtual machine (“VM”) guest OS licenses, server computer hardware and VM software to optimize the costs are generated, generate data center customer plans for additional VMs with guest OS for a projected period of time, provide recommendations on lower cost combination of guest OS licenses, server hardware, and VM software to optimize the cost. Methods also report any underutilized licensed servers and provide recommendations for cost savings when volume licenses can be replaced by instance based software licenses. Methods may generate VM placement recommendations to data center customers while the customers attempt to manually migrate VMs to different server computers.

Abstract: Disclosed are various examples for top-of-rack (TOR) switch replacement in hyper-converged computing environments. A bring-up network configuration is applied to a network switch to install the network switch in a rack. An active workload within the rack is analyzed to identify a workload network configuration for the active workload. The active workload is reassigned to the network switch from a faulty network switch. The network switch is configured based on the workload network configuration for the active workload.

Abstract: Techniques for implementing event proxies in a Functions-as-a-Service (FaaS) infrastructure are provided. In one set of embodiments, a computer system implementing an event proxy can receive an event emitted by an event source, where the computer system is part of a first computing cloud including the FaaS infrastructure, and where the event source is a software service running in a second computing cloud that is distinct from the first computing cloud. The computer system can translate the event from a first format understood by the event source to a second format understood by a function scheduler of the FaaS infrastructure, where the function scheduler is configured to schedule execution of functions on hosts of the FaaS infrastructure. The computer system can then make the translated event available to the function scheduler.