Abstract: In one embodiment, a system for managing a virtualization environment includes host machines implementing a virtualization environment, a plurality of clusters of the host machines, a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), and a VFS cluster manager (CM) configured to distribute storage items among the clusters and receive cluster storage statistics for one or more shares of the VFS. The CM is further configured to, in response to a request from a first FSVM to identify a storage location for a storage item, identify a cluster at which the storage item is to be located based on the cluster storage statistics, identify a second FSVM at which the storage item is to be located based on compute usage statistics of one or more FSVMs in the identified cluster, and send an address of the second FSVM to the first FSVM.

Abstract: In one embodiment, a system for managing a virtualization environment includes a set of host machines, each of which includes a hypervisor, virtual machines, and a virtual machine controller, and a file server splitting system configured to split an existing virtualized file server (VFS) into a set of new virtualized file servers (VFSs), the splitting system configured to select one or more existing file server virtual machines (FSVMs) to be removed from the existing VFS. For each existing FSVM, the splitting system is configured to identify an available FSVM that is separate from the existing VFS, provide resources of the existing FSVM to the available FSVM, incorporate the available FSVM into one of the new VFSs, and remove the existing FSVM from the existing VFS. The splitting system may be further configured to re-direct requests to access storage items served by the existing FSVM to the available FSVM.

Abstract: A breach detection engine detects and mitigates the effects of breaches across one or more data sources. An index is generated based on one or more data sources and the index is queried using keywords indicative of potential breaches. A database of potential breaches is populated based on the query of the index. The potential breach database is queried using keywords associated with a system identity (e.g., a third party). A likelihood of a candidate breach is identified based on a set of breach criteria weights. A network node associated with a candidate breach determined to be an actual breach is identified for isolation or for the performance of one or more additional security actions.

Abstract: In one embodiment, a system for managing a virtualization environment comprises a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines, wherein the VFS is configured to detect a failure of one of the FSVMs on a first one of the host machines, wherein the first host machine is located within a first block of host machines. The VFS may then identify a failover path to a second FSVM. For each storage resource associated with the first FSVM, the VFS may migrate the storage resource to the second FSVM.

Abstract: Particular embodiments provide a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, and a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines and conducts I/O transactions with the one or more virtual disks. A distributed health monitoring service (HMS) may be running on each of the host machines running a FSVM. The HMS may monitor the FSVMs to determine whether any of the FSVMs has failed or is having problems. The HMS may detect that a plurality of the FSVMs have failed, wherein the failed FSVMs form a portion of the FSVMs comprising the VFS. For each of the failed FSVMs, the HMS may reassign an IP address corresponding to the failed FSVM to a live one of the FSVMs.

Abstract: In one embodiment, a system for managing a virtualization environment comprises a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines, and a backup system configured to, in response to a request to access a data item, determine an access frequency for the data item. The backup system is further configured to, in response a request to store a data item, determine a storage tier at which the data item is to be stored in a cloud storage service, wherein the tier is determined based on the access frequency associated with the data item, and store the data item at the determined tier of the cloud storage service.

Abstract: Particular embodiments provide a system for managing a virtualization environment, the system comprising a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, and a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines and conducts I/O transactions with the one or more virtual disks, and the host machines form a cluster. A health monitoring service may monitor the FSVMs to determine whether any of the FSVMs has failed or is having problems. If the health monitoring service detects a failure of one of the FSVMs on a first one of the host machines, for each resource lock associated with the first FSVM, the health monitoring service may reassign the resource lock to another one of the FSVMs.

Abstract: An operator node is configured to enable the management of nodes communicatively coupled to the operator node via a network. A selection of node objects is received by the operator node, the selected node objects including software components for inclusion within a node configuration. A configuration policy is generated based on the selected objects, the configuration policy including a set of tests (such as scripts or executables) that, when run, test for the presence of one or more of the selected node objects. A target node is scanned to determine the configuration of the target node, and the set of tests are applied to identify a set of objects identified by the policy but not installed at the target node. The target node is then re-configured to install the identified set of objects at the target node.

Abstract: An internal network can include a plurality of linked internal nodes, each internal node being configured to communicate with other internal nodes or with one or more external servers over an external network. The internal network can analyze the configuration of the internal nodes and the network traffic between internal nodes of the internal network and external servers. Based on the analysis, a network vulnerability score measuring the vulnerability of the internal network to attack can be determined. If the vulnerability score is below a threshold, the internal network can be isolated from the external network, for example by preventing internal nodes from communicating with or over the external network.

Abstract: In one embodiment, a system for managing a virtualization environment comprises a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines, wherein the VFS is configured to detect a failure of one of the FSVMs on a first one of the host machines, wherein the first host machine is located within a first block of host machines. The VFS may then identify a failover path to a second FSVM. For each storage resource associated with the first FSVM, the VFS may migrate the storage resource to the second FSVM.

Abstract: Particular embodiments provide a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, and a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines and conducts I/O transactions with the one or more virtual disks. A distributed health monitoring service (HMS) may be running on each of the host machines running a FSVM. The HMS may monitor the FSVMs to determine whether any of the FSVMs has failed or is having problems. The HMS may detect that a plurality of the FSVMs have failed, wherein the failed FSVMs form a portion of the FSVMs comprising the VFS. For each of the failed FSVMs, the HMS may reassign an IP address corresponding to the failed FSVM to a live one of the FSVMs.

Abstract: Particular embodiments provide a system for managing a virtualization environment, the system comprising a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, and a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines and conducts I/O transactions with the one or more virtual disks, and the host machines form a cluster. A health monitoring service may monitor the FSVMs to determine whether any of the FSVMs has failed or is having problems. If the health monitoring service detects a failure of one of the FSVMs on a first one of the host machines, for each resource lock associated with the first FSVM, the health monitoring service may reassign the resource lock to another one of the FSVMs.

Abstract: An internal network can include a plurality of linked internal nodes, each internal node being configured to communicate with other internal nodes or with one or more external servers over an external network. The internal network can analyze the configuration of the internal nodes and the network traffic between internal nodes of the internal network and external servers. Based on the analysis, a network vulnerability score measuring the vulnerability of the internal network to attack can be determined. If the vulnerability score is below a threshold, the internal network can be isolated from the external network, for example by preventing internal nodes from communicating with or over the external network.

Abstract: An operator node is configured to enable the management of nodes communicatively coupled to the operator node via a network. A selection of node objects is received by the operator node, the selected node objects including software components for inclusion within a node configuration. A configuration policy is generated based on the selected objects, the configuration policy including a set of tests (such as scripts or executables) that, when run, test for the presence of one or more of the selected node objects. A target node is scanned to determine the configuration of the target node, and the set of tests are applied to identify a set of objects identified by the policy but not installed at the target node. The target node is then re-configured to install the identified set of objects at the target node.

Abstract: An internal network can include a plurality of linked internal nodes, each internal node being configured to communicate with other internal nodes or with one or more external servers over an external network. The internal network can analyze the configuration of the internal nodes and the network traffic between internal nodes of the internal network and external servers. Based on the analysis, a network vulnerability score measuring the vulnerability of the internal network to attack can be determined. If the vulnerability score is below a threshold, the internal network can be isolated from the external network, for example by preventing internal nodes from communicating with or over the external network.

Abstract: In one embodiment, a system for managing a virtualization environment includes a set of host machines, each of which includes a hypervisor, virtual machines, and a virtual machine controller, and a first virtualized file server configured to receive a request to access a storage item located at a second virtualized file server, determine that the storage item is designated as being accessible by other virtualized file servers, identify an FSVM of the second virtualized file server at which the storage item is located, and forward the request to the FSVM of the second virtualized file server. The storage item may be designated as being accessible by other virtualized file servers when the storage item is associated with a predetermined tag value indicating that the storage item is shared among virtualized file servers. The predetermined tag value may be stored in a sharding map in association with the storage item.

Abstract: An internal network can include a plurality of linked internal nodes, each internal node being configured to communicate with other internal nodes or with one or more external servers over an external network. The internal network can analyze the configuration of the internal nodes and the network traffic between internal nodes of the internal network and external servers. Based on the analysis, a network vulnerability score measuring the vulnerability of the internal network to attack can be determined. If the vulnerability score is below a threshold, the internal network can be isolated from the external network, for example by preventing internal nodes from communicating with or over the external network.

Abstract: In one embodiment, a system for managing a virtualization environment comprises a plurality of host machines, one or more virtual disks comprising a plurality of storage devices, a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), wherein each of the FSVMs is running on one of the host machines and conducts I/O transactions with the one or more virtual disks, and a virtualized file server backup system configured to back up data stored in a VFS located a cluster of host machines to an object store, and retrieve the backed-up data as needed to restore the data in the VFS. The object store may be located in a public cloud. The object store may include a low-cost storage medium within the cluster. An FSVM of the VFS may provide an object store interface to low-cost storage media.

Abstract: In one embodiment, a system for managing a virtualization environment includes a set of host machines, each of which includes a hypervisor, virtual machines, and a virtual machine controller, and a first virtualized file server configured to receive a request to access a storage item located at a second virtualized file server, determine that the storage item is designated as being accessible by other virtualized file servers, identify an FSVM of the second virtualized file server at which the storage item is located, and forward the request to the FSVM of the second virtualized file server. The storage item may be designated as being accessible by other virtualized file servers when the storage item is associated with a predetermined tag value indicating that the storage item is shared among virtualized file servers. The predetermined tag value may be stored in a sharding map in association with the storage item.

Abstract: Computer nodes in a network manage the configuration of neighbor nodes and enforce policy compliance by scanning neighboring nodes and taking corrective action based on consensus. A testing node scans a neighboring target node and identifies if the target node violates the policy. The testing node requests common neighbors of the target node to repeat the scan. If the common neighbors agree that the target node violates the policy, a corrective action is taken to ensure compliance with the policy. Corrective action includes reconfiguration of the target node. Nodes also perform negative checking to ensure adherence to separation rules restricting interaction between neighboring nodes. A testing node attempts to perform a restricted action with a neighboring restricted node. If the restricted action is successful, the testing node takes corrective action on the target node to ensure that subsequent attempts to perform the restriction action are denied access in compliance with the policy.