Abstract: A method for cooperative active-standby failover between service routers based on health of services configured on the service routers is presented. In an embodiment, a method comprises determining, by a first service router (“SR”) of a SR cluster, a plurality of aggregate score values for a plurality of SRs of the SR clusters. The SR cluster comprises the first SR which is active, and a second SR. An aggregate score value, of the plurality of aggregate score values, indicates health of one or more services configured on a SR. The method further comprises determining, based on the plurality of aggregate score values, whether the first SR, of the SR cluster, is healthier than the second SR. In response to determining that the first SR is healthier than the second SR, the first SR continues to operate in the active mode; otherwise, the first SR switches to a standby mode.

Abstract: Disclosed are various examples for securing enterprise resources using a virtual private network. A client device can send a first unique device identifier for the client device to a remote management service upon enrollment. When a virtual private network application is first executed, the client device can send a second unique device identifier to the remote management service, where the remote management service is configured to store the second unique device identifier in association with the first unique universal identifier. During subsequent executions of the virtual private network application, the virtual private network service can authenticate the client device by comparing the first unique device identifier and the second unique device identifier to a device identifier received from the remote management service. A machine learning routine can be employed to identify anomalies as the virtual private network application is executed.

Abstract: A system is described for scaling display content on a computing device based on user-to-device distance. A measurement is taken of the distance between the user and the device and a scaling setting is determined using a predefined rule based on the measured distance. The scaling setting is applied to scale content on the display based on the user-to-device distance by changing settings in the operating system or changing scaling in an application. Embodiments include virtual desktop/application and localized implementations.

Abstract: Embodiments enable display updates other than a video stream in a graphical user interface (GUI) to be rendered, encoded, and transmitted exclusive of the video stream. A virtual machine generates a GUI that includes an encoded video stream and other display updates. A virtual graphics processing unit (VGPU) stack associated with the VM renders the other display updates of the GUI to a framebuffer. The rendered display updates are encoded and transmitted to a client for display. The encoded video stream, or a modified (e.g., reduced bit rate) version of the encoded video stream, may be transmitted to the client, such that the client can display the encoded video stream within the GUI. For example, the encoded video stream may be selectively transmitted to the client based on the performance capabilities of the client.

Abstract: A system can provide a visual representation of an inventory of data entities for a distributed computing system. Inventory data including cost and operational data for data entities such as data centers, servers, and virtual machines, can be converted into a format file. The format file can be used to create a tree of nodes and node summaries corresponding to the data entities. A user interface can display hierarchical and isolated views of the tree revealing parent child relationships between data entities within a computing system infrastructure. Node summaries including cost and utilization data can be displayed to reveal how specific sub-costs such as labor and licensing, are driven by data entities in one level of the infrastructure and pushed to respective parent or child data entities in other levels. Views of the tree can be used to determine areas of inefficiency or reduced value within the computing system.

Abstract: A feature selection methodology is disclosed. In a computer-implemented method, components of a computing environment are automatically monitored, and have a feature selection analysis performed thereon. Provided the feature selection analysis determines that features of the components are well defined, a classification of the features is performed. Provided the feature selection analysis determines that features of the components are not well-defined access to those features are discarded. Results of the feature selection methodology are generated.

Abstract: Described herein are systems, methods, and software to manage virtual routing and forwarding (VRF) in a computing environments. In one example, a management service identifies a registration or import of a route target (RT) to communicate in a VRF and identifies a first unique identifier associated with the RT. The management service further identifies a second unique identifier associated with the VRF and compares the first unique identifier to the second unique identifier. When the unique identifiers match, the management service determines that intra-VRF encryption is required for the communication. In contrast, when the unique identifiers do not match, then the management service determine that inter-VRF encryption is required for the communication.

Abstract: A method of establishing a secure communication channel from a first edge device that is in a first network zone across a secure overlay network to a second edge device that is in a second network zone, so that access to a computing device that is in the second network zone can be authenticated by an authentication service that is in the first network zone, includes the steps of establishing a first secure communication channel from the first edge device to the secure overlay network, receiving a request to join the secure overlay network along with administrator credential information and, responsive to the request, transmitting the administrator credential information to the authentication service for authentication through the first secure communication channel and the first edge device, and establishing a second secure communication channel from the second edge device to the secure overlay network if the authentication is received from the authentication service.

Abstract: The present disclosure relates to using maintenance mode to upgrade a distributed system. One method includes determining that a first host of a cluster of a software-defined datacenter (SDDC) is to be upgraded as a part of a rolling upgrade of the hosts of the cluster, wherein the first host is executing a process instance of a cluster store, demoting the process instance to a proxy, creating a replica of the process instance using a different proxy on a second host of the cluster, instructing the first host to enter a maintenance mode, upgrading the first host, and instructing the first host to leave the maintenance mode.

Abstract: Examples of generating contextual compliance policies are described. A meeting invitation can be created by a meeting organizer. The meeting can have compliance rules associated therewith. A compliance policy that facilitates enforcement of the compliance rules during the meeting can be transmitted to attendee client devices and enforced by a management component running on the client devices.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed herein to formally verify a network with both physical and virtual components. The modeling and formal verification is performed by an apparatus comprising: a topology generator to generate a network model including a plurality of devices connected in a network; a flow modeler to add a rule to the network model, the rule to define a flow of network packets through the network model; a reduction mapper to identify the rules common to ones of the devices; and a mapping verifier to verify the network meets a user specification.

Abstract: A method for a shared-memory-based SVM to provide high availability of service is disclosed. In an embodiment, an agent process of the SVM receives a signal that one or more data packets have been queued in a shared memory device of one or more shared memory devices. Upon receiving the signal, the agent process determines whether the SVM has been designated as active for the shared memory device, and if it has, the agent process reads the one or more data packets from the shared memory device. As the data packets are read from the shared memory device: for each data packet, of the one or more data packets read from the shared memory device: the agent process determines whether an indication that the packet is to be transmitted to its destination is received, and if the indication is received, the packet is placed back to the shared memory device.

Abstract: Autoscaling comprises: accessing operational data associated with a pool of servers; determining an expected load associated with a service provided by the pool of servers based at least in part on the operational data; determining an estimated capacity associated with the service provided by the pool of servers; determining that an autoscale operation is to be performed based at least in part on the expected load and the estimated capacity, wherein the autoscale operation automatically scales out one or more additional servers or automatically scales in one or more servers in the pool of servers; and performing the autoscale operation.

Abstract: Embodiments of the disclosure provide techniques managing a log-structured solid state drive (SSD) format in a distributed storage system. SSDs in the distributed storage system maintains a journal of logical changes to storage objects to persist prepared and committed changes in the latency path. The journal includes metadata entries that describe changes and reference data pages. Dense data structures (such as a logical block addressing table) index the metadata entries. To reduce the amount of overhead in I/O operations, the distributed storage system maintains the dense data structures in memory rather than on disk.

Abstract: Some embodiments of the invention provide novel methods for providing a stateful service at a network edge device (e.g., an NSX edge) that has a plurality of north-facing interfaces (e.g., interfaces to an external network) and a plurality of corresponding south-facing interfaces (e.g., interfaces to a logical network). A set of interfaces on each side of the network edge device for a set of equal cost paths, in some embodiments, are bonded together in the network edge device to correspond to a single interface on either side of a logical bridge including at least one logical switch providing a stateful service implemented by the network edge device. The bond is implemented, in some embodiments, by a bonding module executing on the network edge device that maintains a mapping between ingress and egress interfaces to allow deterministic forwarding through the network edge device in the presence of bonded interfaces.

Abstract: The technology disclosed herein enables a guest executing in a host of a host computing system to access an IHMM device of the host computing system. In a particular embodiment, a method provides, in the host, providing a virtualized IHMM device to a guest IHMM device driver in the guest and exchanging IHMM information between the guest IHMM device driver and the virtualized IHMM device. The method further provides, translating the IHMM information between the virtualized IHMM device and a host IHMM device driver on the host. The host IHMM device driver interacts with the host IHMM device based on the IHMM information.

Abstract: Systems and methods are described for managing a user device in multiple management modes. In an example, an agent executing on the user device can enroll the user device with a Unified Endpoint Management (“UEM”) system in a limited management mode. The agent can receive and install a first configuration profile from a server that configures the agent to operate on an unmanaged channel of the user device. In one example, the user device can have a third-party management client that manages the user device on a managed channel. The third-party management client can be removed. The agent can enroll the user device with the UEM in a full management mode. The agent can receive and install a second configuration profile that configures the agent to operate on the managed channel of the user device.

Abstract: An efficient scheduling of IOs in a computing system using dynamic bandwidth regulation includes building up a shared regulator to limit the total IOPS scheduling among all IO classes at any given time. Reserved regulators may be used to place limits on the IOPS scheduled for a particular IO class at any given time. An outstanding IO window may also limit the overall number of outstanding IOs, and/or the bytes of outstanding IOs at any particular time. A first stage of IO scheduling may involve enforcing the reserved regulators to limit the IOPS scheduled for particular IO classes. A second stage of IO scheduling may involve enforcing the shared regulator to limit the total IOPS scheduled for all IO classes.

Abstract: The layout of network-based interfaces can be defined in markup language files rendered in browsers executed on client devices. Interference problems among interface elements in such interfaces can be detected using the tools and processes described herein. The text nodes in a markup language file can be parsed out for processing. A number of pseudo characters or strings can be inserted into the text nodes to mimic the expansion that might occur if the plaintext in the text nodes was translated into a different language. The positions of those text nodes can then be determined and evaluated for interference with each other. Additionally or alternatively, the text nodes can be machine translated to a different language. In turn, the markup file including the translated text nodes can be rendered to evaluate whether the translated text nodes interfere with each other using optical character recognition, for example.

Abstract: Exemplary methods, apparatuses, and systems include a destination node receiving, from a source node, a hash of data stored by the source node and designated for transfer from the source node to the destination node. In response to determining the hash received from the source node maps to data stored by the destination node, the destination node reads the data into a write buffer and transmits an indication to the source node that the data is present at the source node. The destination node reads the data from write buffer and, in response to determining the data read from the write buffer remains unchanged as stored by the destination node, increases a reference count for the data as stored by the destination node.