Abstract: A method for providing quality of service to a plurality of hosts accessing a common resource is described. The common resource may be a middle-tier or back-end server. A client IO request is received at one host of the plurality of hosts from one of a plurality clients executing as software entities on respective hosts. The host determines whether an issue queue is full. The IO request is issued to the common resource when the issue queue is not full. A current average latency observed at the host and an adjusted window size is calculated, based at least in part on the current average latency. The issue queue is resized to correspond with the adjusted window size.

Abstract: A virtual machine (VM) runs on system hardware, which includes a physical network interface device that enables transfer of packets between the VM and a destination over a network. A virtual machine monitor (VMM) exports a hardware interface to the VM and runs on a kernel, which forms a system software layer between the VMM and the system hardware. Pending packets (both transmit and receive) issued by the VM are stored in a memory region that is shared by, that is, addressable by, the VM, the VMM, and the kernel. Rather than always transferring each packet as it is issued, packets are clustered in the shared memory region until a trigger event occurs, whereupon the cluster of packets is passed as a group to the physical network interface device.

Abstract: A system for drift visualization of change data of a data center is disclosed. The data center includes a plurality of configuration items. The system includes a management server in communication with the data center. The management server includes an agent configured to collect the change data from one or more of the plurality of configuration items. A change datastore in communication with the management server is provided to store the change data. A data extractor in communication with the change datastore retrieves the change data and provides a filtered subset of the change data to a display. A policy datastore enables the data extractor to filter the change data based on data center policy violations. The visualization depicts multiple dimensions of change-related data for the items in the data center in a unique and concise manner.

Abstract: In a computing system having virtualization software including a guest operating system (OS), a method for operating wherein virtualization software address space is distributed in guest OS address space that includes: granting the guest OS execute, but not read or write, access, to pages in the virtualization software address space.

Abstract: A software component is executed to carry out a task, the task including a subtask. An external function is called to perform the subtask, the external function executing in a separate thread or process. The component receives an observation recorded by the external function, the observation including an identifier of a possible error condition and instance data associated with the possible error condition. The possible error condition being a cause of the failure of the external function to carry out the subtask. If the task cannot be completed, then a new observation is recorded along with the received observation, the new observation being related to a possible error condition of the component, which is a cause of the failure of the component to carry out the task. When the task can be completed despite the failure of the external function, the observation recorded by the external function is cleared.

Abstract: Methods and systems for providing synchronization of directory data between directory servers are provided. Example embodiments provide a Application Workspace System “AWS,” which enables users to access remote server-based applications using the same interface that they use to access local applications, without needing to know where the application is being accessed. In one embodiment of the AWS, every data entry in the LDAP is automatically replicated to the other directories using XLDAPS technology. In one embodiment, XLDAPS uses XSLT transformation rules to synchronize LDAP changes to different LDAP Directories which may have a different LDAP Schema and a different LDAP Directory Information Tree structure This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Abstract: The present invention facilitates mapping dependencies between software applications, components, and business processes on a computer network. Packets communicated between software applications are sampled to identify characteristics of the packet. The characteristics are used to identify communicating applications and to generate dependency maps of software applications on a computer network.

Abstract: A checkpointing fault tolerance network architecture enables a backup computer system to be remotely located from a primary computer system. An intermediary computer system is situated between the primary computer system and the backup computer system to manage the transmission of checkpoint information to the backup VM in an efficient manner. The intermediary computer system is networked to the primary VM through a first connection and is networked to the backup VM through a second connection. The intermediary computer system identifies updated data corresponding to memory pages that have been least recently modified by the primary VM and transmits such updated data to the backup VM through the first connection. In such manner, the intermediary computer system holds back updated data corresponding to more recently modified memory pages, since such memory pages may be more likely to be updated again in the future.

Abstract: A snapshot of an inventory of a virtualized computer system is produced and a user-editable code is generated therefrom, so that the inventory can be reconstructed entirely or partially. The snapshot includes identifying data for items in the virtualized computer system, and relationship data that indicate hierarchical and non-hierarchical relationships between the items. The items in the inventory of the virtualized computer system include virtual machines, servers on which the virtual machines are running, one or more data centers in which the servers reside, and logical containers such as folders for virtual machines, resource pools that each contain one or more virtual machines, and server clusters that each contain one or more servers.

Abstract: A method of virtual machine (VM) access to physical storage through a direct path to a virtual function (VF) of a storage adapter, the method for use in a system that includes a host computing machine configured to implement a virtualization intermediary and the virtual machine (VM) and that includes the storage adapter the method, comprising: sending virtual SCSI IO request from the VM to the physical storage that identifies a virtual disk address; mapping within the VF the identified virtual address to at least one physical region of the physical storage; creating within the VF a physical SCSI IO request that identifies a physical address for the mapped-to physical region; sending the physical SCSI IO request from the VF to the physical storage.

Abstract: A method for migrating a virtual machine disk (VM disk) from first physical storage to second physical storage while the virtual machine (VM) is running, the method comprising: (a) taking a snapshot of the VM disk as represented by a first parent VM disk stored on the first physical storage, whereby a first child VM disk is created on one of the first or second physical storage; (b) copying the first parent VM disk to the second physical storage as a second parent VM disk; (c) re-parenting the first VM child disk to the second parent VM disk; and (d) consolidating the first child VM disk and the second parent VM disk.

Abstract: Detailed herein are approaches to enabling a secure computing environment. In one approach, a computer system runs an operating system and a virtual machine management console. An input device is used to provide input to the operating system. The operating system is configured such that input received from the input device is directed to the virtual machine management console. The virtual machine management console, in turn, is configured to pass some or all of the input to a virtual machine.

Abstract: System and methods for safely sharing universal serial bus (USB) devices are provided. A request is received to switch from a state in which user mode drivers are not enabled to a state in which user mode drivers are enabled. For each kernel mode USB driver in the system, an I/O control (IOCTL) is called in each kernel mode USB driver. The IOCTL requests that the kernel mode USB driver yield devices on which it has a claim. Also, for each kernel mode USB driver in the system, it is determined if the kernel mode USB driver will yield one or more devices on which it has a claim. For each kernel mode USB driver that will yield and for each device claimed by the kernel mode USB driver for which the kernel mode USB driver respects a request to unclaim the device, a process is executed as if there had been a hot unplug event on the device.

Abstract: A replicated decentralized storage system comprises a plurality of servers that locally store disk images for locally running virtual machines as well as disk images, for failover purposes, for remotely running virtual machines. To ensure that disk images stored for failover purposes are properly replicated upon an update of the disk image on the server running the virtual machine, a hash of a unique value known only to the server running the virtual machine is used to verify the origin of update operations that have been transmitted by the server to the other servers storing replications of the disk image for failover purposes. If verified, the update operations are added to such failover disk images. To enable the replicated decentralized system to recover from a failure of the primary server, the master secret is subdivided into parts and distributed to other servers in the cluster.

Abstract: One embodiment is a method of providing security in a virtualized mobile device including virtualization software that supports one or more virtual machines, the method including: (a) receiving a security policy at the virtualized mobile device, which security policy includes one or more location or location-time scenarios for the virtualized mobile device, which scenarios identify applications to be curtailed, and how they are to be curtailed and applications that are to be enabled, and how they are to be enabled; (b) collecting one or more of mobile device location information or information related to time spent at the location; identifying a scenario that pertaining to the one or more of the location and time information; and (c) curtailing or enabling applications in accordance with the identified scenario.

Abstract: A shared object space in a computer system provides synchronized access to data objects accessible to a plurality of concurrently running applications in the computer system. The shared object space is allocated a portion of memory of the computer system and concurrently running applications are able to connect to the shared object space. The shared object space restricts simultaneous access to data objects by the concurrently running applications by associating locks with the data objects.

Abstract: A virtualization technique, in accordance with one embodiment of the present invention, includes emulating the small computing system interface (SCSI) protocol to access a virtual SCSI storage device backed by a file stored on network attached storage (NAS).

Abstract: A virtualization framework provides security between multiple virtual machines with respect to network communications between the virtual machines and between the virtual machines and a physical network coupled to the underlying physical computer platform. The virtualization framework includes a network interface controller driver that provides an interface to the platform network interface controller and supports execution of a plurality of virtual machines. Each virtual machine includes a virtual network interface controller that provides a network communications path between the virtual machines and to the network interface controller driver. Each virtual network interface controller further contains a programmable network packet filter that controls the selective transfer of network packets with respect to a corresponding virtual machine.

Abstract: A method and system enables transparent authentication and transparent policy enforcement in a fabric of a network. In an exemplary embodiment thereof, a packet stream sent from a network host to a network resource is received at a security system. The security system identifies an authentication exchange packet in the packet stream and determines, using the authentication exchange packet and a directory service, a user identity associated with the packet stream and whether the identified user has authorization to access the network resource. A network policy is created that defines whether the user has access to the network resource.

Abstract: Selecting a master node in a group of computing nodes. Computing nodes exchange suitability messages, candidate messages, and master messages to indicate the state of each node. A deterministic algorithm based on scores and timings is executed by each computing node to encourage each node to select the same master node.