Abstract: Techniques for achieving virtual hardware resources that are individualized across desktop virtual machines (VMs) are identified. Custom resource templates include virtual resource settings that are targeted for specified desktop VMs and that differ from the parent image (i.e., a template or snapshot). A customization manager processes the custom resource templates and applies the corresponding virtual resource settings directly to the specified desktop VMs. To achieve such customization using conventional techniques requires tedious and error-prone manual intervention as well as memory and time-consuming individualized recompose or re-creation operations. Advantageously, by automating and streamlining the customization process, the identified techniques decrease both memory usage and the time required to individualize the desktop VMs.

Abstract: Described herein are systems, methods, and software to enhance network traffic management for virtual machines. In one implementation, a host for a virtual machine may identify applications available for execution on the virtual machine from mounted application volumes and identify firewall rules for the applications. Once identified, the host may identify network traffic for the virtual machine, and forward or block the network traffic for the virtual machine based on the firewall rules.

Abstract: Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow. The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways.

Abstract: A quorum in a cluster of nodes in a quorum-based computing system can be dynamically updated such that even just a single remaining operational node can be sufficient to support continued operation of the computing system, while other node(s) in the cluster are in a failure state. When the other node(s) in the cluster become enabled again, the quorum can be adjusted back to an original quorum of the cluster. The content of storage devices in such other node(s) can be deleted when the node(s) start up from the failure state, and up-to-date content from the operational node can be synchronized into the newly started other node(s), thereby enabling content to be consistent and updated in all of the operational nodes in the cluster/quorum.

Abstract: Some embodiments provide a system for implementing a logical network that spans multiple datacenters. The system includes, at each of the datacenters, a set of host computers that execute (i) data compute nodes (DCNs) belonging to the logical network and (ii) managed forwarding elements (MFEs) that implement the logical network to process data messages for the DCNs executing on the host computers. The system also includes, at each of the datacenters, a set of computing devices implementing logical network gateways for logical forwarding elements (LFEs) of the logical network. The logical network gateways are connected to the logical network gateways for the LFEs at the other datacenters. The MFEs executing on the host computers in a first datacenter communicate with the MFEs executing on the host computers in a second datacenter via the logical network gateways of the first and second datacenters.

Abstract: A shared log system can provide a key-index structure (main map) that allows clients (users) to access the state of objects stored in the shared log system. The client can define secondary indices on the main map to provide access to the data that are tailored to the client's data needs. Each client can generate their own customized set of secondary indices different from other clients.

Abstract: The disclosure provides an approach for seamless hand-off of data traffic in public cloud environments with reverse path filtering. Techniques are provided for activating an edge services gateway (ESG) virtual computing instance (VCI) on a new host in a data center. Before an underlay converges on the new host, inbound and outbound packets for the ESG VCI are sent by the underlay to the old host and the old tunnels the packets to the new host via a pre-created overlay tunnel. For outbound packets, the new host tunnels the packets back to the old host after the ESG VCI performs network address translation of the source address. Once the new host detects that the underlay converges, the new host stops redirecting the outbound packets to the old host.

Abstract: A content driven service discovery and agent monitoring capabilities on Managed Endpoints methodology and system is disclosed. In a computer-implemented method, content information corresponding to an agent of a monitoring system is generated. Content information is pushed to the agent. The content information is used to alter the agent such that an altered agent is generated. The altered agent is generated without requiring a complete update of the agent.

Abstract: A print driver store is usable for redirection printing in a virtualized computing environment that supports virtual desktops. Native print drivers are uploaded to the print driver store from a client side. When an agent attempts to instantiate a virtual printer at the agent side that corresponds to a physical printer at the client side, the agent checks to determine if a native print driver for the physical printer is installed at the agent side. If the native print driver is not installed, then the agent obtains the native print driver from the print driver store and installs the native print driver at the agent side. The agent completes the instantiation of the virtual printer at the agent side and associates the native print driver with the virtual printer.

Abstract: Disclosed are various examples for virtual-machine-specific failover protection. In some examples, a power-on request is received for a protected virtual machine. Virtual-machine-specific failover protection is enabled for the protected virtual machine. The protected virtual machine is executed on a first host of a cluster, and a dynamic virtual machine slot for the protected virtual machine is created on a second host of the cluster. The dynamic virtual machine slot is created to match a hardware resource configuration of the protected virtual machine. An anti-affinity rule is maintained between the protected virtual machine and the dynamic virtual machine slot.

Abstract: The present disclosure is related to methods, systems, and machine-readable media for supporting deduplication in object storage using subset hashes. A plurality of hashes of a plurality of blocks of a plurality of log segments can be received from a software defined data center, wherein each block corresponds to a respective logical address. Each of the plurality of logical addresses can be associated with a respective sequentially-allocated chunk identifier in a logical map. A subset hash comprising a hash of a subset of the plurality of blocks can be determined that corresponds to a contiguous range of the plurality of logical addresses. A search of a hash map for the subset hash can be performed to determine if the subset hash is a duplicate. The subset of the plurality of blocks can be deduplicated responsive to a determination that the subset hash is a duplicate.

Abstract: The current document is directed to methods and systems that carry out live migration of multi-node applications in distributed-computing systems, including cloud-computing applications in cloud-computing facilities. The disclosed methods and systems employ an installer/agent and a data-transformation component to install new versions of a multi-node application within a distributed computing system and to then warm start each application-provided service within the newly installed new-version application nodes. Following a data sync operation, each warm-started application service is brought online to service subsequently received service requests as older-version corresponding services of current application nodes complete request services and terminate, providing live migration from an older version multi-node application to a new-version multi-node application without service-provision interruption.

Abstract: Various examples are described for defining automations for client devices enrolled with a management service. A computing environment can cause one or more user interfaces to be shown in a display of an administrator device that include at least one field for generating an automation that includes a trigger, a condition, and an action to automatically be performed when the condition is satisfied. The trigger defines a time at which the management service compares the condition to device profiles generated for client devices enrolled with the management service. The user interface can forecast a number of client devices that will be affected or subject to an automation, and can display results of the automation as it is executed in real time.

Abstract: Described herein are systems, methods, and software to manage the updates for a container runtime. In one example, a host identifies a request to update a container runtime from a first version to a second version for a container executing in a virtual machine. The host further initiates execution of a second container in a second virtual machine with the second version of the container runtime, wherein the second container uses the same root filesystem as the first container. The host also updates any required networking configurations to direct communications to the second container over the first container and stops execution of the first container.

Abstract: Some embodiments of the invention provide a method of facilitating routing through a software-defined wide area network (SD-WAN) defined for an entity. A first edge forwarding node located at a first multi-machine site of the entity, the first multi-machine site at a first physical location and including a first set of machines, serves as an edge forwarding node for the first set of machines by forwarding packets between the first set of machines and other machines associated with the entity via other forwarding nodes in the SD-WAN. The first edge forwarding node receives configuration data specifying for the first edge forwarding node to serve as a hub forwarding node for forwarding a set of packets from a second set of machines associated with the entity and operating at a second multi-machine site at a second physical location to a third set of machines associated with the entity and operating at a third multi-machine site at a third physical location.

Abstract: A method is provided for a hypervisor to dynamically discover internal address information of a guest kernel on a virtual machine. The method includes locating a kernel exported system call or function in an image of the guest kernel in guest memory of the virtual machine, disassembling machine code of the kernel exported system call or function in the image into assembly code, detecting a pattern from memory references in the assembly code, and, after detecting the pattern, determining the internal address information of the guest kernel from the assembly code.

Abstract: Example methods and systems for multicast packet handling based on flow cache information are described. In one example, a network element may configure flow cache information associated with a multicast flow. The flow cache information may specify a set of actions that is configured based on a sequence of function calls. In response to detecting a multicast packet associated with the multicast flow, fast-path processing may be performed based on the flow cache information. This may include executing a replication action to generate a first packet replica and a second packet replica. First processing action(s) may be executed to process the first packet replica to generate and send a first output packet towards a first multicast destination. Second processing action(s) may be executed to process the second packet replica to generate and send a first output packet towards a second multicast destination.

Abstract: Example methods and systems for capability-aware service request distribution are described. In one example, a network element may obtain a set of capability information associated with multiple load balancers capable of service request handling and identify varying capability levels among the multiple load balancers. The network element may assign unequal path cost information to the multiple load balancers to indicate the varying capability levels. The unequal path cost information may include (a) a first path cost that is assigned to the first load balancer; and (b) a second path cost that is assigned to the second load balancer and different to the first path cost to indicate the lower capability level of the second load balancer compared to the first load balancer. In response to detecting a service request, the service request may be steered towards one of the multiple load balancers based on the unequal path cost information.

Abstract: A computer-implemented method of adjusting a resource credit configuration for cloud resources that includes collecting a resource credit inventory and attributing metadata related to resources from one or more cloud resources. An expected resource demand is determined. A plurality of resource credit configurations is determined that matches the determined expected resource demand. An improved resource credit benefit based on the resource credit inventory and on the plurality of credit configurations is determined that matches the determined expected resource demand. A modified attribute metadata based on the determined improved resource credit benefit is then determined.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for resynchronizing data in a storage system. One of the methods includes receiving, by a first storage subsystem, a plurality of write requests corresponding to respective meta data blocks, wherein the first storage subsystem comprises a meta object; storing, by the first storage subsystem and for each write request, in each disk of the meta object, a version of the corresponding meta data block; determining that a particular disk of the meta object has failed; determining whether one or more valid versions of the meta data block are stored in respective other disks of the meta object; and in response to determining that one or more valid versions of the meta data block are stored in respective other disks of the meta object, resynchronizing the meta data block in the particular disk.