Abstract: Within a domain such as a data center, host server activity monitors running on storage nodes observe meaningful commands sent by host servers to the storage nodes. Inactivity indicated by failure of any of the activity monitors to receive a meaningful command from a host server within a predetermined time limit prompts generation of a message that identifies that host server as possibly being unused. The host server activity monitors are also configured to identify as a possible unused host server any host server that is zoned for at least one of the storage nodes but not masked to any storage objects. If a quiescent host server becomes active, as indicated by resumption of sending meaningful commands to one of the storage nodes, then a message warning of a potential malicious attack is generated.

Abstract: A disaster recovery site storage array causes an instance of a host application or selected executables running on a host server to validate changes to an asynchronously updated replica of a storage object. Snapshots of the replica are generated before and after each set of changes to the replica are received from a remote storage array. Validation is performed by mounting snapshots to the instance of the associated host application and causing the host application instance to validate the data. If a snapshot is determined to be invalid, then the replica to recovered with the most recent known-valid snapshot. Alternatively, if each set of changes is validated prior to being applied to the replica, invalid changes are not applied to the replica. Unvalidated snapshots may be accumulated and validated independently from application of sets of changes to the replica, thereby decoupling validation from replication.

Abstract: Host agents running on host servers provide current and historic host application awareness information to a storage array. The storage array uses the historic host application awareness information to train a host application-specific model of IO characteristics. The current host application awareness information and observed IO characteristics are used as inputs to the model to detect malicious activity. The current and historic host application awareness information includes host application roles such as normal operation, creation of a remote backup, cloning of the storage object, snapping of the storage object, restoring the storage object from a snapshot, scanning a database in the storage object, and scanning the storage object.

Abstract: Within a domain such as a data center, host server activity monitors running on storage nodes observe meaningful commands sent by host servers to the storage nodes. Inactivity indicated by failure of any of the activity monitors to receive a meaningful command from a host server within a predetermined time limit prompts generation of a message that identifies that host server as possibly being unused. The host server activity monitors are also configured to identify as a possible unused host server any host server that is zoned for at least one of the storage nodes but not masked to any storage objects. If a quiescent host server becomes active, as indicated by resumption of sending meaningful commands to one of the storage nodes, then a message warning of a potential malicious attack is generated.

Abstract: An apparatus in one embodiment comprises at least one processing device that includes a processor coupled to a memory. The processing device is configured to obtain buffer availability information from a storage system, the buffer availability information indicating that the storage system is currently experiencing a deficiency in a number of available buffers of a given one of at least first and second different buffer sizes supported by the storage system, and to select particular input-output operations for delivery to the storage system over one or more networks based at least in part on the obtained buffer availability information. Obtaining the buffer availability information from the storage system illustratively comprises sending at least one command from a host device to the storage system. First and second different buffer types having the first and second different buffer sizes may comprise respective different write buffer types within a larger write buffer.

Abstract: A primary storage array calculates signatures of chunks of production device data that are sent to a target device on a secondary storage array. The chunk signatures are sent to a signature device on the secondary storage array, where the chunk signatures are stored within the same LBA range on the signature device as their corresponding chunks are stored on the target device. Snaps of the target and signature device are created and associated as a snap pair. Later, the primary storage array calculates signatures of changed chunks of production device data that are sent to the target device. The changed chunk signatures are sent to the signature device. New snaps of the target and signature device are created and associated as a new snap pair. Chunk data is validated by calculating signatures of the chunks from the target device and comparing those signatures with the chunk signatures from the signature device.

Abstract: A method, comprising: receiving a plurality of first response times, each of the plurality of first response times corresponding to a different one of a plurality of first network paths between a first host device and the first storage array, the plurality of first response times being received from the first host device; receiving a plurality of second response times, each of the plurality of second response times corresponding to a different one of a plurality of second network paths between a second host device and the first storage array, the plurality of second response times being received from the second host device; and processing the plurality of first response times and the plurality of second response times, wherein the plurality of first network paths and the plurality of second network paths are part of a communications network.

Abstract: A primary storage array calculates signatures of chunks of production device data that are sent to a target device on a secondary storage array. The chunk signatures are sent to a signature device on the secondary storage array, where the chunk signatures are stored within the same LBA range on the signature device as their corresponding chunks are stored on the target device. Snaps of the target and signature device are created and associated as a snap pair. Later, the primary storage array calculates signatures of changed chunks of production device data that are sent to the target device. The changed chunk signatures are sent to the signature device. New snaps of the target and signature device are created and associated as a new snap pair. Chunk data is validated by calculating signatures of the chunks from the target device and comparing those signatures with the chunk signatures from the signature device.

Abstract: Techniques for detecting and managing target port overloads due to host initiator or path failures may include: receiving I/Os from initiators of a host at target ports of a data storage system; determining initiator workloads for the initiators; determining target workloads for the target ports; determining that a first of the initiators of the host is a failed initiator that has stopped sending I/Os to the data storage system, wherein the first initiator has a first of the initiator workloads; determining, in accordance with the first initiator workload, revised target workloads for the target ports; determining, in accordance with revised target workloads, whether any of the target ports is expected to be overloaded; and responsive to determining that at least one of the target ports is expected to be overloaded, performing a corrective action to alleviate or reduce an overloaded workload condition expected for the at least one target port.

Abstract: Bandwidth consumption and/or an I/O transmission rate on an I/O path between a port of a storage system and a physical host port may be managed, including determining when multiple virtual host ports correspond to (i.e., are mapped to) a same physical host port. This virtual host port mapping information may be used to more accurately determine bandwidth consumption and I/O transmission rates on I/O connections along an I/O path including the physical host port, and to adjust the bandwidth consumption and/or I/O transmission rate on one more of these I/O connections according to bandwidth thresholds and I/O count thresholds defined for the I/O path (e.g., for the Physical host port of the I/O path).

Abstract: A storage system such as a storage array in a data center calculates per-application power utilization based on monitored IOs. IOs generated by applications that are tolerant of rescheduling may be rescheduled to a time when power is less costly or more available. Storage array power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Server power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Power consumption by the servers, storage array, or both is reduced if power consumption reaches a predetermined level relative to available power.

Abstract: A storage system such as a storage array in a data center calculates per-application power utilization based on monitored IOs. IOs generated by applications that are tolerant of rescheduling may be rescheduled to a time when power is less costly or more available. Storage array power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Server power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Power consumption by the servers, storage array, or both is reduced if power consumption reaches a predetermined level relative to available power.

Abstract: A storage node that maintains separate storage objects for storage of data for different host applications protects those storage objects against ransomware attacks by recognizing variations in data reducibility. Separate data reducibility profiles are generated for each protected storage object. In response to new data being written to one of the protected storage objects, the reducibility of the new data is compared with the data reducibility profile of the protected storage object to which the new data is being written. A mismatch indicates a ransomware attack. Counter-measures may include halting generation or overwriting of snaps, halting replication, and halting backups of the storage object, and generating ransomware attack alert messages. Decryption keys are provided to the storage node if new data is normally provided in an encrypted state.

Abstract: One example method includes receiving, by a backup appliance, a request concerning a dataset, performing, by the backup appliance, an inquiry to determine if end-to-end encryption is enabled for a volume of a target storage array, receiving, by the backup appliance, confirmation from the storage array that end-to-end encryption is enabled for the volume, and based on the confirmation that end-to-end encryption is enabled for the volume, storing the dataset in the volume without performing encryption, compression, or deduplication, of the dataset prior to storage of the dataset in the volume.

Abstract: One example method includes accessing augmented metadata that was stored in connection with a backup dataset, analyzing the augmented metadata, based on the analyzing, creating a guide that identifies processes which, when performed, cause the restoration of the backup dataset to an unsupported target array, and presenting the guide to a user by way of a user interface. The user may then perform the actions indicated in the guide to restore the backup dataset to the unsupported target array.

Abstract: Techniques for detecting and managing target port overloads due to host initiator or path failures may include: receiving I/Os from initiators of a host at target ports of a data storage system; determining initiator workloads for the initiators; determining target workloads for the target ports; determining that a first of the initiators of the host is a failed initiator that has stopped sending I/Os to the data storage system, wherein the first initiator has a first of the initiator workloads; determining, in accordance with the first initiator workload, revised target workloads for the target ports; determining, in accordance with revised target workloads, whether any of the target ports is expected to be overloaded; and responsive to determining that at least one of the target ports is expected to be overloaded, performing a corrective action to alleviate or reduce an overloaded workload condition expected for the at least one target port.

Abstract: An apparatus comprises at least one processing device that is configured to send write requests to a first storage system. The first storage system is configured to participate in a replication process in which data associated with the write requests is replicated from the first storage system to a second storage system that is separate from the first storage system. The at least one processing device is further configured to receive from the first storage system an indication of a write pressure condition arising in the second storage system and relating to replication of the data associated with the write requests from the first storage system to the second storage system, and to at least temporarily limit a manner in which additional write requests are sent to the first storage system responsive to the received indication of the write pressure condition arising in the second storage system.

Abstract: An apparatus comprises at least one processing device comprising a processor and a memory. The at least one processing device is configured to provision a first logical device on a first storage system, to configure the first logical device to support replication from the first storage system to a second storage system, and to initiate generation of a remote backup copy of a second logical device on the second storage system. In conjunction with performance of a verification process for the remote backup copy of the second logical device, the at least one processing device is configured to cause the first logical device to be paired with the remote backup copy of the second logical device, and to mount the first logical device so as to permit performance of the verification process for the remote backup copy utilizing data obtained from the remote backup copy via the first logical device.

Abstract: An apparatus comprises at least one processing device comprising a processor and a memory. The at least one processing device is configured to provision a first logical device on a first storage system, to configure the first logical device to support replication from the first storage system to a second storage system, and to initiate generation of a remote backup copy of a second logical device on the second storage system. In conjunction with performance of a verification process for the remote backup copy of the second logical device, the at least one processing device is configured to cause the first logical device to be paired with the remote backup copy of the second logical device, and to mount the first logical device so as to permit performance of the verification process for the remote backup copy utilizing data obtained from the remote backup copy via the first logical device.

Abstract: Bandwidth consumption and/or an I/O transmission rate on an I/O path between a port of a storage system and a physical host port may be managed, including determining when multiple virtual host ports correspond to (i.e., are mapped to) a same physical host port. This virtual host port mapping information may be used to more accurately determine bandwidth consumption and I/O transmission rates on I/O connections along an I/O path including the physical host port, and to adjust the bandwidth consumption and/or I/O transmission rate on one more of these I/O connections according to bandwidth thresholds and I/O count thresholds defined for the I/O path (e.g., for the Physical host port of the I/O path).