Abstract: One or more aspects of the present disclosure relate to cache layout optimization. In embodiments, an input/output (IO) workload is received by a storage array. Further, cache slot allocations are dynamically adjusted for each cache segment of global memory based on one or more characteristics of the IO workload.

Abstract: A container system facilitates selective migrations of data from high-wear inducing data devices to spare data devices to promote SSD wear levelling. Storage capacity is configured into same-size cells with each container having the same number of cells as RAID width W. The cells are distributed over W SSDs. The containers are subdivided into equal-size data devices, each distributed over the same set of W SSDs as its associated container. Candidate migration source-target pairs are selected using heuristics guided by a prediction model that correlates disk wear rate with total writes of existing workloads. Wear rate predictions are computed using a weighted sum of write rates of all data devices on a disk. Wear rate predictions for candidate migration pairs are computed inclusive of additional wear caused by data migration to select a migration plan.

Abstract: A random read miss slot size selection engine is configured to select between multiple memory slot sizes to optimize slot size allocations for random read miss IO operations. Upon receipt of an IO operation that is a random read miss IO operation, the slot size selection engine obtains a metadata page encompassing multiple entries in addition to an entry associated with the random read miss IO operation. The slot size selection engine performs a metadata temporal analysis to analyze temporal information associated with previous slot allocations identified in the metadata page. The slot size selection engine also performs a metadata spatial analysis to spatially analyze previous slot allocations to neighboring tracks identified in the metadata page. In response to a determination that the metadata page contains a threshold number of recent slot allocations, the spatial analysis is used to determine the slot size to allocate to the random read miss.

Abstract: A system can maintain a group of data processing units and a storage array that comprises a group of sub-logical unit numbers of storage. The system can collect, by a central processing unit, first data indicative of input and output events for the storage array. The system can process, by respective data processing units, respective autoregressive integrated moving average models for respective sub-logical unit numbers of the group of sub-logical unit numbers with the first data, to generate respective statuses that indicate respective frequencies of access of the respective sub-logical unit numbers. The system can determine, by the central processing unit, respective classifications for respective sub-logical unit numbers of the group of sub-logical unit numbers of storage based on the respective statuses. The system can compress, by a compression engine, second data stored in at least some of the respective sub-logical unit numbers based on the respective classifications.

Abstract: Ransomware activity detection and data protection is implemented by a remote R2 storage array on an asynchronous remote data replication facility, on which data from a primary R1 storage array is replicated to the remote storage array. Write operations on storage volumes in a remote data replication group are collected in a capture cycle on the primary storage array, along with IO pattern metadata describing both read and write operations on the storage volumes. At the end of the capture cycle, the update and metadata is transmitted to the remote storage array. The remote storage array receives the update and metadata and temporarily stores the update prior to applying it to its copy of the storage volumes. Ransomware anomaly detection is implemented using the update and metadata, and if ransomware activity is detected, the data on the remote R2 storage array is protected, and the update is not applied.

Abstract: An aspect of the present disclosure relates to one or more data decryption techniques. In embodiments, an input/output operation (IO) stream including one or more encrypted IOs is received by a storage array. Each encrypted IO is assigned an encryption classification. Further, each encrypted IO is processed based on its assigned encryption classification.

Abstract: SSD service life is extended by monitoring wear-level and prompting relocation of unstable data out of SSDs that have reached a soft wear-level threshold such that those SSDs do not contain unstable data when those SSDs reach a hard wear-level threshold. The progression of SSD wear-level is forecasted using an ARIMA algorithm. Unstable data on SSDs between predicted times of reaching the soft and hard thresholds is replaced by stable data from SSDs that have not reached the soft wear-level threshold. The stable data may be snapshot data and deduplicated data and deduplication hashes characterized based on number of references. SSDs that reach the hard threshold without unstable data can remain in service for read IOs until being replaced.

Abstract: The disk drives of an array are organized into clusters of multiples of G+1 drives with G same-size indexed subdivisions, where G is the number of members in a protection group. G+1 groupings are created in each cluster, including G groupings distributed over G drives in single subdivision indices and one grouping distributed diagonally over multiple subdivision indices. A single grouping in at least one cluster is configured as spare capacity. Protection groups are located in the other groupings. Drive IO loading is rebalanced by swapping the location of a selected protection group with the location of the spare grouping. The protection group to be relocated may be selected by using LOF scores to identify a cluster with IO loading outlier drives that are overloaded and then calculating IO loading that would result from swapping locations of each protection group in that cluster with the spare grouping.

Abstract: Ransomware activity detection and data protection is implemented by a remote R2 storage array on an asynchronous remote data replication facility, on which data from a primary R1 storage array is replicated to the remote storage array. Write operations on storage volumes in a remote data replication group are collected in a capture cycle on the primary storage array, along with IO pattern metadata describing both read and write operations on the storage volumes. At the end of the capture cycle, the update and metadata is transmitted to the remote storage array. The remote storage array receives the update and metadata and temporarily stores the update prior to applying it to its copy of the storage volumes. Ransomware anomaly detection is implemented using the update and metadata, and if ransomware activity is detected, the data on the remote R2 storage array is protected, and the update is not applied.

Abstract: A software analysis system collects a first set of time series counter values from an original version of software instrumented with software telemetry counters, and collects a second set of time series counter values from a modified version of the software that also is instrumented with the software telemetry counters. The first time series become dimensions input to train a weight matrix of a first self-organizing map, to cause the first self-organizing map to cluster the time series into a group of first clusters describing execution of the original software. The second time series become dimensions input to train a weight matrix of a second self-organizing map, to cause the second self-organizing map to cluster the time series into a group of second clusters describing execution of the modified software. Deviation analysis between the first and second groups of clusters is used to identify execution differences between the software versions.

Abstract: A method of predicting usage levels of solid-state drives (SSDS) includes receiving time series usage data from each SSD over a plurality of monitoring intervals (lags), and using a first portion of the time series usage data to train (fit) an ARIMA model to the time series data. A unique ARIMA model (order) is determined for each SSD from the unique time series % usage data of each SSD. The ARMIA model is then fit to the time series % usage data and used in a predictive manner to predict a future date when the % usage will exceed a threshold % usage value. By predicting when the SSDs will meet particular thresholds, it is possible to plan for and procure replacement SSDs to enable currently installed SSDs to be removed from service before the currently installed SSD % usage levels exceed threshold values, thus enabling the currently installed SSDs to be repurposed.

Abstract: Aspects of the present disclosure relate to detecting and correcting a storage array's drive sectors to prevent data loss. In embodiments, a storage array's telemetry information is monitored. Further, one or more state or operational metrics of the storage array's storage drives are measured. Additionally, each storage drive is scrubbed based on each drive's relative scrubbing priority defined by the telemetry information and each storage drive's state or operation metrics.

Abstract: SSD service life is extended by monitoring wear-level and prompting relocation of unstable data out of SSDs that have reached a soft wear-level threshold such that those SSDs do not contain unstable data when those SSDs reach a hard wear-level threshold. The progression of SSD wear-level is forecasted using an ARIMA algorithm. Unstable data on SSDs between predicted times of reaching the soft and hard thresholds is replaced by stable data from SSDs that have not reached the soft wear-level threshold. The stable data may be snapshot data and deduplicated data and deduplication hashes characterized based on number of references. SSDs that reach the hard threshold without unstable data can remain in service for read IOs until being replaced.

Abstract: The disk drives of an array are organized into clusters of multiples of G+1 drives with G same-size indexed subdivisions, where G is the number of members in a protection group. G+1 groupings are created in each cluster, including G groupings distributed over G drives in single subdivision indices and one grouping distributed diagonally over multiple subdivision indices. A single grouping in at least one cluster is configured as spare capacity. Protection groups are located in the other groupings. Drive IO loading is rebalanced by swapping the location of a selected protection group with the location of the spare grouping. The protection group to be relocated may be selected by using LOF scores to identify a cluster with IO loading outlier drives that are overloaded and then calculating IO loading that would result from swapping locations of each protection group in that cluster with the spare grouping.

Abstract: The lifespans of the solid stated drives (SSDs) of a storage array are modelled using linear regression with monitored wear level and power-on time. The models predict when individual SSDs will reach a wear level corresponding to readiness for replacement. A drive replacement process makes efficient use of available empty drive slots to replace SSDs in batches. SSDs that are ready for replacement are ranked in terms of priority for replacement. If the number of SSDs that are ready for replacement exceeds the number of available empty drive slots, then ranking us used to assign individual SSDs to different batches for replacement.

Abstract: A method of predicting usage levels of solid-state drives (SSDS) includes receiving time series usage data from each SSD over a plurality of monitoring intervals (lags), and using a first portion of the time series usage data to train (fit) an ARIMA model to the time series data. A unique ARIMA model (order) is determined for each SSD from the unique time series % usage data of each SSD. The ARMIA model is then fit to the time series % usage data and used in a predictive manner to predict a future date when the % usage will exceed a threshold % usage value. By predicting when the SSDs will meet particular thresholds, it is possible to plan for and procure replacement SSDs to enable currently installed SSDs to be removed from service before the currently installed SSD % usage levels exceed threshold values, thus enabling the currently installed SSDs to be repurposed.

Abstract: A multivariate time series model such as a Vector Auto Regression (VAR) model is built using fabric utilization, disk utilization, and CPU utilization time series data. The VAR model leverages interdependencies between multiple time-dependent variables to predict the start and length of an aperiodic backup time window, and to cause backup operations to occur during the aperiodic backup time window to thereby exploit the aperiodic backup time window for use in connection with backup operations. By automatically starting backup operations during predicted aperiodic backup time windows where the CPU, disk, and fabric utilization values are predicted to be low, it is possible to implement backup operations during time windows where the backup operations are less likely to interfere with primary application workloads, or system application workloads that need to be implemented to maintain optimal operation of the storage system.

Abstract: A data storage node includes a plurality of compute nodes that allocate portions of local memory to a shared cache. The shared cache is configured with mirrored and non-mirrored segments that are sized as a function of the percentage of write IOs and read 10s in a historical traffic workload profile specific to an organization or storage node. The mirrored and non-mirrored segments are separately configured with pools of data slots. Within each segment, each pool is associated with same-size data slots that differ in size relative to the data slots of other pools. The sizes of the pools in the mirrored segment are set based on write IO size distribution in the historical traffic workload profile. The sizes of the pools in the non-mirrored segment are set based on read IO size distribution in the historical traffic workload profile.

Abstract: A data storage node includes a plurality of compute nodes that allocate portions of local memory to a shared cache. The shared cache is configured with mirrored and non- mirrored segments that are sized as a function of the percentage of write IOs and read IOs in a historical traffic workload profile specific to an organization or storage node. The mirrored and non-mirrored segments are separately configured with pools of data slots. Within each segment, each pool is associated with same-size data slots that differ in size relative to the data slots of other pools. The sizes of the pools in the mirrored segment are set based on write IO size distribution in the historical traffic workload profile. The sizes of the pools in the non-mirrored segment are set based on read IO size distribution in the historical traffic workload profile.

Abstract: A multivariate time series model such as a Vector Auto Regression (VAR) model is built using fabric utilization, disk utilization, and CPU utilization time series data. The VAR model leverages interdependencies between multiple time-dependent variables to predict the start and length of an aperiodic backup time window, and to cause backup operations to occur during the aperiodic backup time window to thereby exploit the aperiodic backup time window for use in connection with backup operations. By automatically starting backup operations during predicted aperiodic backup time windows where the CPU, disk, and fabric utilization values are predicted to be low, it is possible to implement backup operations during time windows where the backup operations are less likely to interfere with primary application workloads, or system application workloads that need to be implemented to maintain optimal operation of the storage system.