Abstract: A method, apparatus and computer program product for handling secure information (e.g., a password, an account number, a personal identification number (PIN), a user identifier, an encryption key, and a path where said secure information is stored) is presented. Secure information is stored in a software container. A plurality of representations of the secure information is provided, each of the plurality of representations for use under different conditions. Dependent on the particular condition, at least one of the plurality of representations of the secure information is provided by the container. The container holds the secure information during all stages of processing in a manner that prevents unauthorized parties from gaining access to the secret in clear form.

Abstract: Techniques disclosed herein describe a data retrieval process for storing management data from a network environment using an efficient polling-based approach without sacrificing the real-time aspect of data retrieval that a push model provides. The process is highly scalable and reliable, and is useful in Network Address Translation (NAT) environments because the number of holes in a NAT firewall is minimized. The data retrieval component uses intelligent polling to retrieve data and store the data in a central database without overloading the system. A data retrieval component polls a data collection agent for a dataset. The data collection agent transfers the data set and a poll indication of when a subsequent data set will be ready for transfer. Subsequent polling is based on a processor load at a data retrieval component.

Abstract: A SAN management agent computes a validator corresponding to a full data set from which a relative (change) data set is derived. The validator, such as a checksum, identifies the full data set to which the relative data set is applicable. The validator is transmitted with the relative data set, and the store process compares the validator with the previous validator stored with the full data set in a database. If the validators correspond (i.e. match), then the received relative data set is applicable to the full data set stored at the database, and the relative data set may be processed as a change set. The remote agent therefore computes the validator on a full data set at a remote node, and transmits the validator with the change set. Subsequent relative data sets may then compare the current validator of the DB data set with the validator from which the relative set was derived.

Abstract: Data structures, methods, and apparatus useful in configuring agent services operating in a storage area network are provided. The data structures may include a list of agent types for which agent services are configurable for operation by agents of those agent types in a storage area network; for each agent type in the list of agent types, a corresponding list of configurable agent services operable by agents of the agent type; for each configurable agent service in each list of configurable agent services, a corresponding list of configurable parameters for the configurable agent service; and for each configurable parameter in each list of configurable parameters, at least one parameter value associated with the configurable parameter. Procedures and apparatus are provided for configuring agent services by updating elements of the data structures and providing the updated elements to the agent services.

Abstract: A storage area network management application operates using agents for management of resources. Authenticity is verified in installing an agent on a host computer system in the storage area network. A file is identified for use in installing the agent. The file is signed to produce a digital signature for the file. A certificate is sent to a recipient for use in verifying authenticity of information. The file and digital signature are sent to the recipient. At the recipient, the certificate and the digital signature are used to verify the file. An agent installation operation is performed, using the file, to install the agent on the host computer system.

Abstract: In a storage area network, agents provide transactions of data sets containing updates to manageable entities in a SAN. A SAN server avoids intermittent dissemination of events pertaining to a single transaction by storing events in a cache until completion of all subtransactions in the transaction, and then disseminating all events pertaining to the transaction. Transactions are broken down into update sections, each containing one or more subtransactions collectively defining the entire transaction. Update sections corresponding to the transaction are tagged with a section ID. Events indicating completion of processing of the update section are identified by the section ID, and suppressed temporarily by storing them in the event cache pending completion of the transaction. Other events not matching a tagged section ID are allowed to disseminate. Upon completion of the transaction, events for all section IDs corresponding to the transaction are disseminated from the cache.

Abstract: A method and apparatus for managing a transaction in a storage area network is presented. A request is received from an agent process at a management server. The management server provides a ticket relating to the request. The ticket is sent to the agent process. The management server identifies a storage process related to the ticket. The storage process contacts the agent process and receives the information from the agent process.

Abstract: A system determines status of agent execution of a command in a network. The system identifies a command to be performed by an agent and issues the command to the agent for execution. The agent operates a status manager that tracks execution status of commands in the agent. The system sends status requests to the agent to determine a status of execution of the command by the agent and the agent responds and sends a status response indicating the status of the execution of the command by the agent. Applications are thus provided with current status of execution of long running commands in an agent.

Abstract: A system receives, from an agent, an agent timestamp associated with a production of a collection of data. The system creates a history associated with the collection of data and the agent timestamp. The system receives an indication that processing the collection of data is complete, and associates the collection of data and the agent timestamp with at least one resource referenced within the collection of data.

Abstract: A log collection utility (LCU) operable in a storage area network (SAN) to identify the various types of log files generated in the SAN computes the location of each of the log files, and collects the log files for consolidation and analysis in a common repository. The LCU periodically collects and/or processes the log files by enumerating the location of each of the log files in a log file designator, and generates a script operable for identifying each of the log files sought. A resulting task definition file lists each of the log files identified. The log collection utility therefore finds log files generated by dissimilar applications and nodes in the SAN via a log type definition that enumerates each of the log files in a manner that is agnostic to operating systems, platforms, and directory structures around which the log files are written and stored.

Abstract: Techniques for locating and collecting application logs are disclosed. Embodiments disclosed herein can be advantageously utilized to collect application logs from a plurality of computers in a network. For example, embodiments disclosed herein can be used to identify and collect application logs from a plurality of host computers in a storage area network.

Abstract: A storage area network (SAN) license validator manages data collection policies (DCPs) in deployed SAN agents by identifying data collection policies corresponding to unlicensed features, and disabling the DCPs for the unlicensed features. Thus, the agents need not expend computational and memory resources to gather data for unlicensed features that will not be queried. Agents receive a set of data collection policies (DCPs) for licensed features for which the corresponding data will be gathered and reported to the MODB. DCPs for unlicensed features are disabled in the agents that would have executed them, either by removing or canceling from an active DCP list or by omitting the unlicensed DCPs from the startup sequence of the agent. In this manner, agents operate with only the DCPs for licensed products and corresponding features, and need not gather extraneous data.

Abstract: In a storage area network (SAN), a SAN management application provides a security audit log of security sensitive user actions performed across the storage area network. In a SAN, multiple services operate to perform requested user actions. Configurations herein substantially overcome the shortcomings of conventional SAN security event logging by providing a comprehensive security audit mechanism operable to identify and record user actions. An event normalizer disposed in each of the services identifies requested user actions, creates a uniform user action object, and sends the user action object to a coalescer operable to receive user action objects from the plurality of services in the SAN. The user action object provides a generic template responsive to each of the event normalizers in the services. The event normalizers normalize event properties and attributes concerning a user action into the generic user action object, and employs preexisting conduits for gathering and recording events.

Abstract: A SAN management agent performs hierarchical based partitioning. Partitions expressed as a hierarchy of related manageable entities allow partitioning based on the relations in the hierarchy. Related manageable entities often trigger updates to database elements common to both of the related manageable entities. The related manageable entities often take the form of a hierarchy (tree) indicative of these relations. Grouping the updates affecting related manageable entities together in the same partition allows the database elements affected by the related updates to occur from a single retrieval of the common database element. By partitioning updates of related manageable entities together, the common database elements are more likely to be paged or cached in memory at the time the update processing updates the common database element. Accordingly, tree-based partitioning identifies relations between manageable entities, and designates related manageable entities by traversing the relations.

Abstract: A system receives notification from an agent of that agent's availability for data collection from resources within a network. The system identifies, from the notification, a version value associated with the agent. The system determines, from the version value, a set of operations to be assigned to the agent that will be compatible with that agent, and assigns a subset of the set of operations to the agent to enable that agent to collect data from resources in the network.

Abstract: In a storage area network (SAN), different tasks may expect different types of commands for commencing execution, such as interactive or offline, and may have different formats for reporting status and completion, such as log files or message based. A framework for defining the business logic enveloped in a particular task, and providing a common manner of deploying, or enabling invocation, of the task provides consistent operator control for scheduling, monitoring, ensuring completion, and tracking errors and other events. Business logic modules are identified as commands corresponding to a task. Transactions including a set of the commands define an ordered sequence for completing the task. The operator requests a particular set of tasks, using a selection tree, and the task manager builds a corresponding execution tree to identify and map the transactions and commands of the task to the execution tree to optimize execution and mitigate redundancies.

Abstract: A log collection utility (LCU) operable in a storage area network (SAN) to identify the various types of log files generated in the SAN, compute the location of each of the log files, and collect the log files for consolidation and analysis in a common repository. A designator file enumerates log files for collection. The LCU generates a discovery script for each host, and the hosts generate an identity of each of the log files via execution of the discovery script. The LCU generates a collection script operable to gather the each of the log files. The LCU thus gathers a plurality of log files generated by dissimilar applications and nodes in the SAN via a declarative mechanism that specifies the types of log files via a log file designator, and generates executable scripts that collects the log files in a manner that is agnostic to operating systems, platforms, and directory structures.

Abstract: In a storage area network, agents provide transactions of data sets containing updates to manageable entities in a SAN. A SAN server avoids intermittent dissemination of events pertaining to a single transaction by storing events in a cache until completion of all subtransactions in the transaction, and then disseminating all events pertaining to the transaction. Transactions are broken down into update sections, each containing one or more subtransactions collectively defining the entire transaction. Update sections corresponding to the transaction are tagged with a section ID. Events indicating completion of processing of the update section are identified by the section ID, and suppressed temporarily by storing them in the event cache pending completion of the transaction. Other events not matching a tagged section ID are allowed to disseminate. Upon completion of the transaction, events for all section IDs corresponding to the transaction are disseminated from the cache.

Abstract: An agent installer operates to install an agent on a plurality of host computer systems using a bulk automated installation process that identifies at least one agent to be installed on a plurality of host computer systems and performs prerequisite checking of each of the plurality of host computer systems to determine which host computer systems of the plurality of host computer system are capable of supporting operation of the at least one agent. For each host computer system of the plurality of host computer systems that is capable of supporting operation of the at least one agent, the agent installer performs an automated bulk agent installation operation to install the at least one agent on that host computer system.

Abstract: A method, apparatus and computer program product for handling secure information (e.g., a password, an account number, a personal identification number (PIN), a user identifier, an encryption key, and a path where said secure information is stored) is presented. Secure information is stored in a software container. A plurality of representations of the secure information is provided, each of the plurality of representations for use under different conditions. Dependent on the particular condition, at least one of the plurality of representations of the secure information is provided by the container. The container holds the secure information during all stages of processing in a manner that prevents unauthorized parties from gaining access to the secret in clear form.