Abstract: Some embodiments of the invention provide a method for cloning a set of one or more applications implemented by a first set of machines connected through a first logical network that defines a virtual private cloud (VPC) in a set of one or more datacenters. The method detects that the first logical network does not have sufficient resources to process a set of network traffic destined for the set of one or more applications implemented by the first set of machines. Based on said detecting, the method uses a set of network configuration data that configures a set of logical forwarding elements (LFEs) of the first logical network to define a cloned, second logical network for connecting a cloned, second set of machines that implement a second set of one or more applications. The method uses the cloned, second logical network to process at least a subset of the network traffic destined to the set of applications.

Abstract: Hybrid synchronization using a shadow component includes detecting a first component of a plurality of mirrored components of a distributed data object becoming unavailable. The mirrored components include a delta component (a special shadow component) and a regular mirror (shadow) component. The delta component indicates a shorter history of changes to data blocks of a log-structured file system (LFS) than is indicated by the regular mirror component. During the unavailability of the first component, at least one write I/O is committed by the delta component. The commit is tracked by the delta component in a first tracking bitmap associated with the delta component. Based at least on detecting the first component becoming available, the first component is synchronized with data from the delta component, based at least on changed data blocks indicated in the first tracking bitmap.

Abstract: The disclosure provides for integrating virtual machine (VM) and host networking, forwarding port data and occupation status to host and VM endpoints. Examples synchronize, by a host agent, port reservations with a guest agent on a first VM on the host; receive an indication that a VM port on the first VM is occupied; based at least on receiving the indication that the VM port is occupied, update the port reservations to include that a host port corresponding to the VM port is occupied; receive incoming external traffic on the host port; and based at least on the port reservations and receiving the incoming external traffic on the host port, route the incoming external traffic to the VM port on the first VM. VM-based application behavior thus appears more similar to that of native applications.

Abstract: Disclosed are aspects of interference-aware virtual machine assignment for systems that include graphics processing units (GPUs) that are virtual GPU (vGPU) enabled. In some examples, an interference function is used to predict interference for assignment of a workload to a graphics processing unit (GPU). The interference function outputs a predicted interference to place the workload on the GPU. The workload is assigned to the GPU based on a comparison of the predicted interference to a plurality of predicted interferences for the workload on various GPUs.

Abstract: Processes for managing computing processes within a plurality of data centers configured to provide a cloud computing environment are described. An exemplary process includes executing a process on a first host of a plurality of hosts. When the process is executing on the first host, a first network identifier associated with the plurality of hosts is not a network identifier of a pool of network identifiers associated with the cloud computing environment and first and second route tables respectively corresponding to first and second data centers of the plurality of data centers associate the first network identifier with the first host. The exemplary process further includes detecting an event associated with the process. In response to detecting the event associated with the process, the first and second route tables are respectively updated to associate the first network identifier with a second host of the plurality of hosts.

Abstract: A method of optimizing network processing in a system comprising a physical host and a set of physical network interface controllers (PNICs) is provided. The physical host includes a forwarding element. The method includes determining that a set of conditions is satisfied to bypass the forwarding element for exchanging packets between a particular data compute node (DCN) and a particular PNIC. The set of conditions includes the particular DCN being the only DCN connected to the forwarding element and the particular PNIC being the only PNIC connected to the forwarding element. The method exchanges packets between the particular DCN and the particular PNIC bypassing the forwarding element. The method determines that at least one condition in said set of conditions is not satisfied. The method utilizes the forwarding element to exchange packets between the particular DCN and the particular PNIC.

Abstract: Some embodiments provide a method for a global manager that manages a logical network spanning multiple physical sites. The method receives a set of data describing a modification to a definition of the logical network. From multiple queues that each correspond to a different one of the physical sites spanned by the logical network, the method identifying a set of queues to which to store the received set of data. The method stores the received set of data in the identified set of queues. From each respective queue in the identified set of queues, the method sends the set of data through a respective channel between the global manager and a respective local manager at the respective physical site corresponding to the respective queue.

Abstract: In a virtualized computer system in which a guest operating system runs on a virtual machine of a virtualized computer system, a computer-implemented method of providing the guest operating system with direct access to a hardware device coupled to the virtualized computer system via a communication interface, the method including: (a) obtaining first configuration register information corresponding to the hardware device, the hardware device connected to the virtualized computer system via the communication interface; (b) creating a passthrough device by copying at least part of the first configuration register information to generate second configuration register information corresponding to the passthrough device; and (c) enabling the guest operating system to directly access the hardware device corresponding to the passthrough device by providing access to the second configuration register information of the passthrough device.

Abstract: This disclosure is directed to automated processes for attesting to trustworthiness of a host considered for connection to a data center network. The attestation process is performed in two attestation phases. In the first phase, attestation is performed on a smart network interface controller (“SNIC”) connected to an internal bus of the host using a first trusted platform module (“TPM”) of the SNIC. In the second phase, attestation is performed on the host by the SNIC using a second TPM connected to the internal bus of the host in response to a determination that the SNIC is trustworthy. The host is connected to the data center network in response to a determination by the SNIC that the host is trustworthy.

Abstract: Examples described herein include systems and methods for dynamically displaying features in a GUI of a portal application that facilitates access to other applications. An example method can include receiving a push notification, from a notification service, at a user device upon which the portal application is installed. The push notification can indicate that a new feature is available for the portal application executing on the user device. The example method can include requesting, from the management server, at least one command for modifying the GUI of the portal application. The management server can provide the command or provide instructions for the user device to retrieve the command. The method can include receiving at least one command. The method can also include modifying the GUI of the portal application based on the received command and displaying the modified GUI.

Abstract: In some embodiments, a method receives a share of a signature of a decision block from at least a portion of the plurality of replicas. The share of the signature being generated when a respective replica signs the decision block and the decision block includes a set of requests from a client for a service. A combined signature is created based on the share of the signature block from at least the portion of the plurality of replicas. The method broadcasts a message that includes the combined signature to the plurality of replicas. The plurality of replicas use the combined signature to determine whether to process the decision block for the service.

Abstract: A method for managing data associated with objects stored in a cloud storage is provided. The method receives, at a first compute node, first data associated with an object stored in the cloud storage, the first compute node being one of a plurality of compute nodes that store data associated with different objects as storage objects in a log-structured merging (LSM) tree data structure. The method then assigns a first unique name to a first storage object associated with the first data, the first unique name comprising a combination of at least an identifier identifying the first compute node and a first incremental local value. The method stores the first storage object in a first level (L0) of the LSM tree data structure.

Abstract: A system can include a network analysis platform that applies performance models to determine if a coverage degradation exists at a network cell, such as at a base station. The performance models are pre-trained based on network telemetry data. For a session at a cell, an expected quality of service (“QoS”) metric can be compared to an actual QoS metric to determine whether the session is impacted by coverage degradation. Throughput is an example QoS metric. If the number of impacted sessions exceeds a threshold, the base station can be highlighted on a GUI. Additionally, the network analysis platform can perform root cause analysis of a victim cell.

Abstract: Methods and apparatus to deploy workload domains in virtual server racks are disclosed. An example apparatus includes a policy manager to determine an availability option and a performance option of the workload domain based on a domain type and determine capacity options based on a user selection of the availability option and a user selection of the performance option by a first user, a deployment manager to identify first ones of a plurality of computing resources to form a placement solution for the workload domain based on the user selection of the availability and performance options, and based on a user selection of one of the determined capacity options by the first user, the plurality of computing resources stored in a resource database accessible by the first user and a second user, and a resource manager to reserve the first ones of the plurality of computing resources to deploy the workload domain for the first user.

Abstract: A system and method of de-elevating a process created in a computing device of a computer system are disclosed. In certain aspects, a method includes detecting a user login within a login session of a computing device in the computer system, the login session having a default security context. The method also includes creating a de-elevated security context for the login session, wherein the de-elevated security context has fewer privileges than the default security context. The method also includes detecting a process being created within the login session. The method further includes determining that the process is potentially malicious by comparing an intended state and a digital profile of the computing device. The method also includes launching the process using the de-elevated security context.

Abstract: A domain-name-based network-connection attestation system provides for more user friendly and less error prone (compared to IP-address-based attestation systems) updating of a whitelist used to determine whether or not to allow a requested network connection. A guest agent extracts from a DNS reply a domain name, and an IP address mapped to a domain name. The agent enters these values in an agent DNS cache. When a process requests a connection to an IP address, the agent uses the IP address to determine the domain name from the agent DNS cache. The agent then determines whether the IP address is mapped to the process identity in a domain-name-based whitelist. If it is, the connection is attested to and allowed; if it is not, a secondary IP address whitelist can be checked.

Abstract: Some embodiments provide a method of aggregating and providing packet metrics collected during a live packet monitoring session performed for packets matching a specified set of characteristics. The method receives, from one or more computing devices that process packets during the live packet monitoring session, multiple metrics associated with a set of packets matching the specified set of characteristics. Metrics associated with each packet in the set are accompanied by a packet identifier (ID) used to tag the packet by an initial computing device that processed the packet. The method uses the accompanying packet IDs to aggregate the received plurality of metrics. The method provides (i) an aggregated set of session metrics for the set of packets matching the specified set of characteristics during the live packet monitoring session and (ii) individual packet metrics using the packet IDs for at least one packet in the set of packets.

Abstract: A disclosed example method to automate deployment of a software defined data center includes generating, by executing an instruction with at least one processor, a task list based on tasks provided in an automation plan to deploy the software defined data center; determining, by executing an instruction with the at least one processor, dependencies between the tasks prior to executing the tasks; determining, by executing an instruction with the at least one processor, whether a resource that is to be an output of a first one of the tasks exists before execution of the first one of the tasks; removing, by executing an instruction with the at least one processor, the first one of the tasks from the task list when the resource exists before execution of the first one of the tasks; generating an execution schedule, by executing an instruction with the at least one processor, based on the dependencies and ones of the tasks remaining in the task list; and executing, with the at least one processor, the ones of the

Abstract: Disclosed are various approaches performing actions on data items in a third-party service with a network-accessible application programming interface from an email client. The email client can perform an action as specified by an email service profile, which specifies how to identify the email message, the data item and how to interact with the network-accessible application programming interface.

Abstract: The present invention entails a highly available system comprising at least one host with at least one monitoring agent fit to send data, a cloud based proxy fit to receive the data, wherein said proxy comprises: an adapter, a master monitoring agent fit to command the at least one monitoring agent, and a failover server. The highly available system is further made up of at least one secondary cloud based proxy capable of communicating with the cloud based proxy, wherein the secondary cloud based proxy also comprises: a second adapter, a second master monitoring agent fit to command at least one monitoring agent, and a second failover server fit to communicate with the failover server. Finally, the highly available system also includes a node, wherein the node communicates with at least the cloud based proxy and the secondary cloud based proxy.