Abstract: Events from one or more primary systems associated with one or more tenants are received. The received events are stored in a message queue. At least a portion of the events in the message queue are ingested for organization and storage in a data store. One or more progress identifiers associated with ingesting of the events in the message queue are tracked. An event query is received from an external system. The event query is rewritten into a first component query for the data store and a second component query for the message queue based at least in part on a progress identifier. A result of the first component query and a result of the second component query are combined to determine a result of the event query.

Abstract: An identification of a new primary snapshot created for a primary storage system is received. A change tracking time window that is at least a portion of a period between a first capture time associated with a previous primary snapshot and a second capture time associated with the new primary snapshot is determined. Entries of a storage log of the primary storage system occurring within the change tracking time window are analyzed to coalesce changes identified in the entries of the storage log occurring within the change tracking time window into a change tracking result set. The change tracking result set is used to identify at least a portion of data changes between the previous primary snapshot and the new primary snapshot to capture in a new backup snapshot stored at a secondary storage system.

Abstract: A file directory tree structure of a selected storage snapshot is dynamically divided into different portions. A plurality of the different file directory tree structure portions are analyzed in parallel to identify any changes of the selected storage snapshot from a previous storage snapshot. To analyze each of the plurality of the different file directory tree structure portions, a processor is further configured to traverse and compare a corresponding file directory tree structure portion of the selected storage snapshot with a corresponding portion of a file directory tree structure of the previous storage snapshot while at least another one of the plurality of the different file directory tree structure portions of the selected storage snapshot is being analyzed in parallel.

Abstract: A plurality of logical storage segments of storage drives of a plurality of storage nodes are identified. At least one of the storage nodes includes at least a first logical storage segment and a second logical storage segment included in the plurality of logical storage segments. A distributed and replicated data store using a portion of the plurality of logical storage segments that excludes at least the second logical storage segment is provided. An available storage capacity metric associated with the plurality of logical storage segments is determined to meet a first threshold. In response to the determination that the available storage capacity metric meets the first threshold, at least the second logical storage segment is dynamically deployed for use in providing the distributed and replicated data store in a manner that increases a storage capacity of the data store while maintaining a fault tolerance policy of the distributed and replicated data store.

Abstract: An identification of a new primary snapshot created for a primary storage system is received. A threshold time window based on a capture time associated with the new primary snapshot is determined. Entries of a storage log of the primary storage system occurring within the threshold time window are analyzed to identify any objects of the primary storage system that have changed during the threshold time window. Changed objects to capture in a new secondary backup stored at a secondary storage system and corresponding to the new primary snapshot are identified. Metadata of the new primary snapshot and metadata of a previous secondary backup are compared to determine for each of the objects of the primary storage system identified as having changed during the threshold time window whether a change to an object since the previous secondary backup is captured in the new primary snapshot.

Abstract: Embodiments presented herein disclose techniques for capturing a snapshot of a file system object (e.g., a file or a directory) that is associated with a write journal having outstanding data. A bridge process in a storage server receives a request to capture a snapshot of a file system object. The snapshot is a backup of a state of the file system object in a given point in time. Upon determining that the file system object has one or more outstanding updates recorded in a write journal, the bridge process generates a copy of the write journal. The bridge process captures the snapshot of the file system object. The bridge process also associates the copy of the write journal with the snapshot of the file system object.

Abstract: A technique for restoring content is described. The technique includes receiving a specification of content to be restored to a target storage from a data source. The technique also includes determining task units to be performed to restore the specified content. Each task unit is associated with a corresponding assigned weight value. Based on the corresponding assigned weight values, the task units are distributed to different task groups. The task groups are processed in parallel with each other to concurrently perform at least a portion of the distributed task units.

Abstract: A datacenter management system uses data collection proxies to collect performance data and configuration data for different physical and virtual entities in the datacenter. A schema is used to represent the different entities, entity relationships, and entity properties in the datacenter. A search engine identifies the intent of a natural language based search query based on the schema and a datacenter dictionary. The search engine then searches the data based on the search query intent. A dictionary manager converts both periodic and aperiodic data into a time series. This allows the search engine to operate as a time machine identifying both performance data and configuration data for any selectable time period.

Abstract: Embodiments presented herein disclose techniques for capturing a snapshot of a file system object (e.g., a file or a directory) that is associated with a write journal having outstanding data. A bridge process in a storage server receives a request to capture a snapshot of a file system object. The snapshot is a backup of a state of the file system object in a given point in time. Upon determining that the file system object has one or more outstanding updates recorded in a write journal, the bridge process generates a copy of the write journal. The bridge process captures the snapshot of the file system object. The bridge process also associates the copy of the write journal with the snapshot of the file system object.

Abstract: Application-level data in a storage system are evaluated. For example, a backup analysis tool retrieves a backup object stored in the storage system. The backup analysis tool reconstructs an application object from the backup object. The backup analysis tool accesses the first application object according to a native application format associated with the first object.

Abstract: One or more storage locations of file inodes in a data source to be backed up are identified. Filesystem metadata information is extracted from the one or more identified storage locations. At least one item of the extracted filesystem metadata information includes a reference to a parent inode. The extracted filesystem metadata information is stored in a data structure. The contents of the data structure are analyzed to index a relationship structure of file system contents of the data source.

Abstract: Metadata included in a certificate received from an application or service is analyzed. The application or service is permitted to communicate with other applications or services associated with a data management as a service infrastructure based on a version number associated with a storage tenant included in the analyzed metadata.

Abstract: Application-level data in a storage system are evaluated. For example, a backup analysis tool retrieves a backup object stored in the storage system. The backup analysis tool reconstructs an application object from the backup object. The backup analysis tool accesses the first application object according to a native application format associated with the first object.

Abstract: A view gateway is configured to receive a first query in a first programming language from a client. The view gateway is configured to select a template from a plurality of templates. A view gateway is configured to compile the first query and the selected template into a second query. A view gateway is configured to send the second query to a data store for processing. A view gateway is configured to receive a query result that is responsive to the second query; and send the query result to the client.

Abstract: A plurality of logical storage segments of storage drives of a plurality of storage nodes are identified. At least one of the storage nodes includes at least a first logical storage segment and a second logical storage segment included in the plurality of logical storage segments. A distributed and replicated data store using a portion of the plurality of logical storage segments that excludes at least the second logical storage segment is provided. An available storage capacity metric associated with the plurality of logical storage segments is determined to meet a first threshold. In response to the determination that the available storage capacity metric meets the first threshold, at least the second logical storage segment is dynamically deployed for use in providing the distributed and replicated data store in a manner that increases a storage capacity of the data store while maintaining a fault tolerance policy of the distributed and replicated data store.

Abstract: An amount of data change associated with a version of a content file with respect to one or more previous versions of the content file is determined. The amount of change associated with the version of the content file is determined using a tree data structure associated with the content file that is stored on a storage cluster. One or more statistics associated with backup snapshot are provided to a server. The server is configured to determine that the amount of data change associated with the version of the content file is anomalous based in part on the one or more statistics associated with the backup snapshot. A notification that data associated with the backup snapshot is potentially infected by malicious software is received from the server. The version of the content file is indicated as being potentially infected by malicious software.

Abstract: A size associated with a first content file is determined to be less than a threshold size. In response to determining that the size associated with the first content file is less than the threshold size, a combined metadata structure is updated at least in part by combining metadata of the first content file with metadata of a second content file in the combined metadata structure. A snapshot tree is updated to reference a first portion of the combined metadata structure corresponding to the first content file and to reference a second portion of the combined metadata structure corresponding to the second content file.

Abstract: A mechanism for storing indexing updates is described. A secondary storage system is configured to store a backup of a primary storage system. A plurality of different indexing updates of a data repository associated with the secondary storage system is received. An indexing update may include metadata and/or updates to the metadata for a data item in the backup. The indexing updates may be obtained from an indexing process. At least a portion of the indexing updates are sent for storage in an intermediate store. An indication to commit the indexing updates is received. In response, the indexing updates including the at least the portion of the indexing updates are requested to be committed. The indexing updates batched together into a batch to be committed to a metadata store.

Abstract: A size associated with a first content file is determined to be less than a threshold size. In response to determining that the size associated with the first content file is less than the threshold size, a combined metadata structure is updated at least in part by combining metadata of the first content file with metadata of a second content file in the combined metadata structure. A snapshot tree is updated to reference a first portion of the combined metadata structure corresponding to the first content file and to reference a second portion of the combined metadata structure corresponding to the second content file.

Abstract: An amount of data change associated with a version of a content file with respect to one or more previous versions of the content file is determined. The amount of change associated with the version of the content file is determined using a tree data structure associated with the content file that is stored on a storage cluster. One or more statistics associated with backup snapshot are provided to a server. The server is configured to determine that the amount of data change associated with the version of the content file is anomalous based in part on the one or more statistics associated with the backup snapshot. A notification that data associated with the backup snapshot is potentially infected by malicious software is received from the server. The version of the content file is indicated as being potentially infected by malicious software.