Abstract: An apparatus in an illustrative embodiment comprises at least one processing device comprising a processor coupled to a memory. The at least one processing device is configured to receive in a storage system from at least one host device at least first and second different input-output timeout values for respective first and second different logical storage devices of the storage system, to store the received input-output timeout values in association with respective identifiers of the first and second logical storage devices in at least one data structure of the storage system, and to control processing of input-output operations, received in the storage system from the at least one host device and targeting respective ones of the first and second logical storage devices, based at least in part on the corresponding input-output timeout values stored in the at least one data structure of the storage system.

Abstract: Host agents running on host servers provide current and historic host application awareness information to a storage array. The storage array uses the historic host application awareness information to train a host application-specific model of IO characteristics. The current host application awareness information and observed IO characteristics are used as inputs to the model to detect malicious activity. The current and historic host application awareness information includes host application roles such as normal operation, creation of a remote backup, cloning of the storage object, snapping of the storage object, restoring the storage object from a snapshot, scanning a database in the storage object, and scanning the storage object.

Abstract: One example method includes receiving, by a backup appliance, a request concerning a dataset, performing, by the backup appliance, an inquiry to determine if end-to-end encryption is enabled for a volume of a target storage array, receiving, by the backup appliance, confirmation from the storage array that end-to-end encryption is enabled for the volume, and based on the confirmation that end-to-end encryption is enabled for the volume, storing the dataset in the volume without performing encryption, compression, or deduplication, of the dataset prior to storage of the dataset in the volume.

Abstract: A disaster recovery site storage array causes an instance of a host application or selected executables running on a host server to validate changes to an asynchronously updated replica of a storage object. Snapshots of the replica are generated before and after each set of changes to the replica are received from a remote storage array. Validation is performed by mounting snapshots to the instance of the associated host application and causing the host application instance to validate the data. If a snapshot is determined to be invalid, then the replica to recovered with the most recent known-valid snapshot. Alternatively, if each set of changes is validated prior to being applied to the replica, invalid changes are not applied to the replica. Unvalidated snapshots may be accumulated and validated independently from application of sets of changes to the replica, thereby decoupling validation from replication.

Abstract: Target port resets sent from a host server are used to identify HBA faults. A storage array monitors receipt of resets and calculates reset counts for each HBA port of each host server. If there are more than X resets within Y seconds received by a storage array port from a particular HBA port, that HBA port is identified as faulty if the storage array port has not received resets from other HBAs or other ports of the same HBA. If the storage array port has received resets from other ports of the same HBA but not from other HBAs, then the HBA is identified as faulty. If the initiators are grouped, both the HBA port and HBA are identified as potentially faulty. If none of the HBAs or HBA ports are identified as faulty, the cause of the resets is localized to the storage array, inter-switch links, or congestion.

Abstract: An apparatus in one embodiment comprises at least one processing device that includes a processor coupled to a memory. The processing device is configured to obtain buffer availability information from a storage system, the buffer availability information indicating that the storage system is currently experiencing a deficiency in a number of available buffers of a given one of at least first and second different buffer sizes supported by the storage system, and to select particular input-output operations for delivery to the storage system over one or more networks based at least in part on the obtained buffer availability information. Obtaining the buffer availability information from the storage system illustratively comprises sending at least one command from a host device to the storage system. First and second different buffer types having the first and second different buffer sizes may comprise respective different write buffer types within a larger write buffer.

Abstract: One example method includes receiving, by a backup appliance, a request concerning a dataset, performing, by the backup appliance, an inquiry to determine if end-to-end encryption is enabled for a volume of a target storage array, receiving, by the backup appliance, confirmation from the storage array that end-to-end encryption is enabled for the volume, and based on the confirmation that end-to-end encryption is enabled for the volume, storing the dataset in the volume without performing encryption, compression, or deduplication, of the dataset prior to storage of the dataset in the volume.

Abstract: Within a domain such as a data center, host server activity monitors running on storage nodes observe meaningful commands sent by host servers to the storage nodes. Inactivity indicated by failure of any of the activity monitors to receive a meaningful command from a host server within a predetermined time limit prompts generation of a message that identifies that host server as possibly being unused. The host server activity monitors are also configured to identify as a possible unused host server any host server that is zoned for at least one of the storage nodes but not masked to any storage objects. If a quiescent host server becomes active, as indicated by resumption of sending meaningful commands to one of the storage nodes, then a message warning of a potential malicious attack is generated.

Abstract: A disaster recovery site storage array causes an instance of a host application or selected executables running on a host server to validate changes to an asynchronously updated replica of a storage object. Snapshots of the replica are generated before and after each set of changes to the replica are received from a remote storage array. Validation is performed by mounting snapshots to the instance of the associated host application and causing the host application instance to validate the data. If a snapshot is determined to be invalid, then the replica to recovered with the most recent known-valid snapshot. Alternatively, if each set of changes is validated prior to being applied to the replica, invalid changes are not applied to the replica. Unvalidated snapshots may be accumulated and validated independently from application of sets of changes to the replica, thereby decoupling validation from replication.

Abstract: Host agents running on host servers provide current and historic host application awareness information to a storage array. The storage array uses the historic host application awareness information to train a host application-specific model of IO characteristics. The current host application awareness information and observed IO characteristics are used as inputs to the model to detect malicious activity. The current and historic host application awareness information includes host application roles such as normal operation, creation of a remote backup, cloning of the storage object, snapping of the storage object, restoring the storage object from a snapshot, scanning a database in the storage object, and scanning the storage object.

Abstract: Within a domain such as a data center, host server activity monitors running on storage nodes observe meaningful commands sent by host servers to the storage nodes. Inactivity indicated by failure of any of the activity monitors to receive a meaningful command from a host server within a predetermined time limit prompts generation of a message that identifies that host server as possibly being unused. The host server activity monitors are also configured to identify as a possible unused host server any host server that is zoned for at least one of the storage nodes but not masked to any storage objects. If a quiescent host server becomes active, as indicated by resumption of sending meaningful commands to one of the storage nodes, then a message warning of a potential malicious attack is generated.

Abstract: An apparatus in one embodiment comprises at least one processing device that includes a processor coupled to a memory. The processing device is configured to obtain buffer availability information from a storage system, the buffer availability information indicating that the storage system is currently experiencing a deficiency in a number of available buffers of a given one of at least first and second different buffer sizes supported by the storage system, and to select particular input-output operations for delivery to the storage system over one or more networks based at least in part on the obtained buffer availability information. Obtaining the buffer availability information from the storage system illustratively comprises sending at least one command from a host device to the storage system. First and second different buffer types having the first and second different buffer sizes may comprise respective different write buffer types within a larger write buffer.

Abstract: A primary storage array calculates signatures of chunks of production device data that are sent to a target device on a secondary storage array. The chunk signatures are sent to a signature device on the secondary storage array, where the chunk signatures are stored within the same LBA range on the signature device as their corresponding chunks are stored on the target device. Snaps of the target and signature device are created and associated as a snap pair. Later, the primary storage array calculates signatures of changed chunks of production device data that are sent to the target device. The changed chunk signatures are sent to the signature device. New snaps of the target and signature device are created and associated as a new snap pair. Chunk data is validated by calculating signatures of the chunks from the target device and comparing those signatures with the chunk signatures from the signature device.

Abstract: A method, comprising: receiving a plurality of first response times, each of the plurality of first response times corresponding to a different one of a plurality of first network paths between a first host device and the first storage array, the plurality of first response times being received from the first host device; receiving a plurality of second response times, each of the plurality of second response times corresponding to a different one of a plurality of second network paths between a second host device and the first storage array, the plurality of second response times being received from the second host device; and processing the plurality of first response times and the plurality of second response times, wherein the plurality of first network paths and the plurality of second network paths are part of a communications network.

Abstract: A primary storage array calculates signatures of chunks of production device data that are sent to a target device on a secondary storage array. The chunk signatures are sent to a signature device on the secondary storage array, where the chunk signatures are stored within the same LBA range on the signature device as their corresponding chunks are stored on the target device. Snaps of the target and signature device are created and associated as a snap pair. Later, the primary storage array calculates signatures of changed chunks of production device data that are sent to the target device. The changed chunk signatures are sent to the signature device. New snaps of the target and signature device are created and associated as a new snap pair. Chunk data is validated by calculating signatures of the chunks from the target device and comparing those signatures with the chunk signatures from the signature device.

Abstract: Techniques for detecting and managing target port overloads due to host initiator or path failures may include: receiving I/Os from initiators of a host at target ports of a data storage system; determining initiator workloads for the initiators; determining target workloads for the target ports; determining that a first of the initiators of the host is a failed initiator that has stopped sending I/Os to the data storage system, wherein the first initiator has a first of the initiator workloads; determining, in accordance with the first initiator workload, revised target workloads for the target ports; determining, in accordance with revised target workloads, whether any of the target ports is expected to be overloaded; and responsive to determining that at least one of the target ports is expected to be overloaded, performing a corrective action to alleviate or reduce an overloaded workload condition expected for the at least one target port.

Abstract: A storage system such as a storage array in a data center calculates per-application power utilization based on monitored IOs. IOs generated by applications that are tolerant of rescheduling may be rescheduled to a time when power is less costly or more available. Storage array power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Server power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Power consumption by the servers, storage array, or both is reduced if power consumption reaches a predetermined level relative to available power.

Abstract: Bandwidth consumption and/or an I/O transmission rate on an I/O path between a port of a storage system and a physical host port may be managed, including determining when multiple virtual host ports correspond to (i.e., are mapped to) a same physical host port. This virtual host port mapping information may be used to more accurately determine bandwidth consumption and I/O transmission rates on I/O connections along an I/O path including the physical host port, and to adjust the bandwidth consumption and/or I/O transmission rate on one more of these I/O connections according to bandwidth thresholds and I/O count thresholds defined for the I/O path (e.g., for the Physical host port of the I/O path).

Abstract: A storage system such as a storage array in a data center calculates per-application power utilization based on monitored IOs. IOs generated by applications that are tolerant of rescheduling may be rescheduled to a time when power is less costly or more available. Storage array power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Server power consumption is reduced if all services host applications can tolerate greater IO latency without service level violations. Power consumption by the servers, storage array, or both is reduced if power consumption reaches a predetermined level relative to available power.

Abstract: A storage node that maintains separate storage objects for storage of data for different host applications protects those storage objects against ransomware attacks by recognizing variations in data reducibility. Separate data reducibility profiles are generated for each protected storage object. In response to new data being written to one of the protected storage objects, the reducibility of the new data is compared with the data reducibility profile of the protected storage object to which the new data is being written. A mismatch indicates a ransomware attack. Counter-measures may include halting generation or overwriting of snaps, halting replication, and halting backups of the storage object, and generating ransomware attack alert messages. Decryption keys are provided to the storage node if new data is normally provided in an encrypted state.