Abstract: One or more aspects of the present disclosure relate to dynamically selecting a storage array and corresponding input/output (IO) paths between a host and the storage array. In embodiments, a virtual storage volume (VSV) can be established for a host entity using one or more storage device portions from a plurality of storage arrays. In addition, IO servicing metric parameters can be dynamically measured. The servicing metric parameters can define metrics corresponding to the VSV's assigned ports on each of the storage arrays or network latency between the host and each of the plurality of storage arrays. Further, a primary storage array from the plurality of storage arrays can be selected based on the IO servicing metrics.

Abstract: One or more aspects of the present disclosure relate to enhancing modular device snapshot-to-encryption-key associations. In embodiments, an input/output (IO) workload can be received at a storage array. The IO workload can include an IO request to write encrypted data on the storage array. The IO request's metadata can also be parsed for information such as snap parameters. Further, an encryption key identifier (ID) can be received from a host, and snapshots of a storage unit can be created with the parsed information and the key ID.

Abstract: Within a domain such as a data center, host server activity monitors running on storage nodes observe meaningful commands sent by host servers to the storage nodes. Inactivity indicated by failure of any of the activity monitors to receive a meaningful command from a host server within a predetermined time limit prompts generation of a message that identifies that host server as possibly being unused. The host server activity monitors are also configured to identify as a possible unused host server any host server that is zoned for at least one of the storage nodes but not masked to any storage objects. If a quiescent host server becomes active, as indicated by resumption of sending meaningful commands to one of the storage nodes, then a message warning of a potential malicious attack is generated.

Abstract: A disaster recovery site storage array causes an instance of a host application or selected executables running on a host server to validate changes to an asynchronously updated replica of a storage object. Snapshots of the replica are generated before and after each set of changes to the replica are received from a remote storage array. Validation is performed by mounting snapshots to the instance of the associated host application and causing the host application instance to validate the data. If a snapshot is determined to be invalid, then the replica to recovered with the most recent known-valid snapshot. Alternatively, if each set of changes is validated prior to being applied to the replica, invalid changes are not applied to the replica. Unvalidated snapshots may be accumulated and validated independently from application of sets of changes to the replica, thereby decoupling validation from replication.

Abstract: An apparatus comprises at least one processing device. The at least one processing device is configured, for each of a plurality of logical storage devices of a storage system, to determine in a multi-path layer of a layered software stack of a host device a performance level for that logical storage device, to communicate the performance levels for respective ones of the logical storage devices from the multi-path layer of the layered software stack of the host device to at least one additional layer of the software stack above the multi-path layer, and to select particular ones of the logical storage devices for assignment to particular storage roles in the additional layer based at least in part on the communicated performance levels. The additional layer in some embodiments comprises an application layer configured to automatically select a particular one of the logical storage devices for a particular storage role.

Abstract: The cause of a failure to satisfy a high priority service level objective of a storage object or storage group is localized within a storage array. Storage objects that have been assigned low priority service level objectives are analyzed to determine whether their performance paths overlap with the performance path of the high priority service level objective storage object or storage group at the location of the cause of the failure. The low priority service level objective storage objects having performance paths that overlap with the performance path of the high priority service level objective storage object or storage group at the location of the cause of the failure are targeted for IO data rate reduction in order to free resources to restore compliance with the high priority service level objective. The other low priority service level objective storage objects are not targeted.

Abstract: The cause of a failure to satisfy a high priority service level objective of a storage object or storage group is localized within a storage array. Storage objects that have been assigned low priority service level objectives are analyzed to determine whether their performance paths overlap with the performance path of the high priority service level objective storage object or storage group at the location of the cause of the failure. The low priority service level objective storage objects having performance paths that overlap with the performance path of the high priority service level objective storage object or storage group at the location of the cause of the failure are targeted for IO data rate reduction in order to free resources to restore compliance with the high priority service level objective. The other low priority service level objective storage objects are not targeted.

Abstract: A profile of characteristics of a normal snapshot of a storage object is computed from previous snapshots of the storage object. Characteristics of a new snapshot are compared with the characteristics in the profile to identify an anomaly indicative of a malicious attack. The characteristics include percent data changed between consecutive snapshots, write LBA dispersion, write data reducibility, number and size of writes, write workload profile, and write content profile. The new snapshot is only vaulted or air-gapped if all its characteristics are within ranges defined by the profile.

Abstract: At least one processing device is configured to control delivery of input-output (TO) operations from a host device to a storage system over selected ones of a plurality of paths through a network. The at least one processing device is further configured to designate one or more of the paths as being associated with a link performance issue, to temporarily suspend utilization of the one or more designated paths for delivery of IO operations from the host device to the storage system, to detect a configuration change that is indicative of potential resolution of the link performance issue, and to resume utilization of the one or more designated paths responsive to the detected configuration change. The at least one processing device illustratively comprises a multi-path input-output (MPIO) driver of the host device.

Abstract: A processing device illustratively includes a processor coupled to a memory, and is configured to initiate a background copy process in a host device to copy data from a first storage system to a second storage system. The processing device receives input-output (IO) processing pressure feedback from at least one of the first and second storage systems, and adjusts one or more characteristics of the background copy process based at least in part on the received IO processing pressure feedback. The processing device may comprise, for example, host level mirroring (HLM) logic configured to control execution of the background copy process for one or more logical storage devices. Adjusting one or more characteristics of the background copy process based at least in part on the received IO processing pressure feedback may comprise, for example, reducing a rate of the background copy process responsive to the received IO processing pressure feedback.

Abstract: Host agents running on host servers provide current and historic host application awareness information to a storage array. The storage array uses the historic host application awareness information to train a host application-specific model of IO characteristics. The current host application awareness information and observed IO characteristics are used as inputs to the model to detect malicious activity. The current and historic host application awareness information includes host application roles such as normal operation, creation of a remote backup, cloning of the storage object, snapping of the storage object, restoring the storage object from a snapshot, scanning a database in the storage object, and scanning the storage object.

Abstract: Migration of data to maintain data resiliency, including receiving user-input indicating a first data resiliency of first data; storing the first data at a first storage device of the storage devices, the first storage device associated with the first data resiliency; monitoring vectors associated with performance of the storage devices; determining, based on the monitoring, that a particular vector fails to meet an associated performance criteria for the first data resiliency of the first data, and in response: analyzing characteristics of each of the storage devices, including a resiliency of each of the storage devices; identifying, based on the characteristics of each of the storage devices, a second storage device of the storage devices for migration of the first data such that the first resiliency of the first data is maintained; and migrating the first data from the first storage device to the second storage device

Abstract: A network-attached storage of a computing system connected to a network may monitor the network for file access commands from equipment of another computing system to identify whether one of the file access commands corresponds to a nefarious attempt to access information stored at the storage. A service, application, or script, running at the storage, may create a fake query and a fake response thereto. The fake query or corresponding response may contain information generated to attract an attacker that may be using the other computing system to passively monitor the network and, upon detecting the attractive, but fake, message information, transmit a request according to an address, or path, or other information that the fake message(s) may include. The service/app/script may notify the computing system that a potential hacker has infiltrated the system when it receives a request for information at the fake address or path.

Abstract: A processing device illustratively includes a processor coupled to a memory, and is configured to initiate a background copy process in a host device to copy data from a first storage system to a second storage system. The processing device receives input-output (IO) processing pressure feedback from at least one of the first and second storage systems, and adjusts one or more characteristics of the background copy process based at least in part on the received IO processing pressure feedback. The processing device may comprise, for example, host level mirroring (HLM) logic configured to control execution of the background copy process for one or more logical storage devices. Adjusting one or more characteristics of the background copy process based at least in part on the received IO processing pressure feedback may comprise, for example, reducing a rate of the background copy process responsive to the received IO processing pressure feedback.

Abstract: Within a domain such as a data center, host server activity monitors running on storage nodes observe meaningful commands sent by host servers to the storage nodes. Inactivity indicated by failure of any of the activity monitors to receive a meaningful command from a host server within a predetermined time limit prompts generation of a message that identifies that host server as possibly being unused. The host server activity monitors are also configured to identify as a possible unused host server any host server that is zoned for at least one of the storage nodes but not masked to any storage objects. If a quiescent host server becomes active, as indicated by resumption of sending meaningful commands to one of the storage nodes, then a message warning of a potential malicious attack is generated.

Abstract: An apparatus comprises at least one processing device that includes a processor and a memory coupled to the processor. The at least one processing device is configured to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a storage area network, to generate statistics relating to the received storage access protocol commands, to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network, and to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system. A multi-path input-output (MPIO) driver of the one or more host devices may be provided with the alert and configured to initiate one or more remediation actions responsive to the alert.

Abstract: An apparatus in one embodiment comprises at least one processing device that includes a processor coupled to a memory. The processing device is configured to obtain buffer availability information from a storage system, the buffer availability information indicating that the storage system is currently experiencing a deficiency in a number of available buffers of a given one of at least first and second different buffer sizes supported by the storage system, and to select particular input-output operations for delivery to the storage system over one or more networks based at least in part on the obtained buffer availability information. Obtaining the buffer availability information from the storage system illustratively comprises sending at least one command from a host device to the storage system. First and second different buffer types having the first and second different buffer sizes may comprise respective different write buffer types within a larger write buffer.

Abstract: A storage system comprises a plurality of storage devices, and is configured to establish a production drive group comprising a first subset of the storage devices, using a first firmware-level configuration process, and to establish a stealth drive group comprising a second subset of the storage devices, using a second firmware-level configuration process, the storage devices of the stealth drive group thereby being separated at a firmware level of the storage system from the storage devices of the production drive group. The storage system is further configured to copy data of one or more logical storage volumes from the production drive group to the stealth drive group, and responsive to completion of the copying of the data of the one or more logical storage volumes from the production drive group to the stealth drive group, to initiate a firmware-level reconfiguration process for the storage devices of the stealth drive group.

Abstract: An apparatus comprises at least one processing device. The at least one processing device is configured to identify at least one logical storage device that has a first service level objective and is exhibiting a deficiency in one or more performance metrics, to identify one or more additional logical storage devices each having a second service level objective lower than the first service level objective and not exhibiting a deficiency in the one or more performance metrics, to generate at least one false-positive signal specifying the one or more additional logical storage devices as each exhibiting a deficiency in the one or more performance metrics, and to provide the at least one false-positive signal to at least one host device. The at least one host device is configured to respond to the at least one false-positive signal by throttling input-output operations for the one or more additional logical storage devices.

Abstract: A system can train a generator neural network to produce a trained generator neural network of a generative adversarial network, wherein the trained generator neural network is configured to output a bill of materials in response to receiving functional requirements for a computer system. The system can train a discriminator neural network to produce a trained discriminator neural network of the generative adversarial network, wherein the trained discriminator neural network is configured to output whether the bill of materials received from the trained generator neural network satisfies the functional requirements for the computer system. The system can produce an output bill of materials from the generative adversarial network based on the functional requirements. The system can store the output bill of materials in the system.