Abstract: Described herein are techniques for automating media agent state management. For example, if a media agent is running poorly, then the media agent can be disabled and an alternate media agent can perform secondary copy job operations in place of the poorly running media agent. To determine whether a media agent is running poorly, a storage manager can determine whether the media agent has an anomalous number of failed jobs, pending jobs, and/or long running jobs and/or can determine whether the amount of resources used by the media agent is high or is increasing constantly, at a constant rate, or at a near constant rate.

Abstract: This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.

Abstract: An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Abstract: An illustrative data storage management system uses a control layer that controls information content presented to users and ensures information privacy between diverse tenants and/or resellers who share the system. The system populates a relationship database as transactions roll in (intake processing), and uses information in the relationship database later when processing responses (output processing). The relationship database comprises associations between e.g., a company ID and any number of entities that were created by or on behalf of the company or that are related to the company's service in the system. The control layer parses raw results that are responsive to requests for information and prevents others' information from being included in the responsive message(s). The techniques disclosed herein are not limited to shared systems managed by service providers, and may be implemented in fully owned and operated systems to add security and privacy among diverse users and/or departments.

Abstract: An illustrative data storage management system uses a control layer that controls information content presented to users and ensures information privacy between diverse tenants and/or resellers who share the system. The system populates a relationship database as transactions roll in (intake processing), and uses information in the relationship database later when processing responses (output processing). The relationship database comprises associations between e.g., a company ID and any number of entities that were created by or on behalf of the company or that are related to the company’s service in the system. The control layer parses raw results that are responsive to requests for information and prevents others’ information from being included in the responsive message(s). The techniques disclosed herein are not limited to shared systems managed by service providers, and may be implemented in fully owned and operated systems to add security and privacy among diverse users and/or departments.

Abstract: A client computing device receives a behavior model corresponding to a user group associated with a user. The behavior model has been trained with monitored user interactions of one or more files associated with the user group. The client computing device further mounts a snapshot of a file and determines, based on the behavior model, which files of the mounted snapshot to transfer to a locally accessible cache. During use of the client computing device, the client computing device may determine whether the mounted snapshot is accessible. If the mounted snapshot is not accessible, the client computing device may selectively delete, based on the behavior model, one or more of the files stored in the locally accessible cache. If the mounted snapshot is accessible, the client computing device may update the one or more files of the locally accessible cache with monitored user interactions with the mounted snapshot.

Abstract: An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Abstract: An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Abstract: A system or method for managing an auxiliary data location and a secondary data location. A client computing device may have secondary copies of its primary data stored at a secondary storage device, as well as auxiliary copies of the secondary copies at an auxiliary storage device. The client computing device may move from one geographic location that is near the secondary storage device to a second geographic location that is far from the secondary storage device, but closer to the auxiliary storage device. A method is provided with input signals in response to the move, and outputs a probability value that the move is temporary or permanent. Based on the output, a storage manager that manages the client computing device may then direct the client computing device to use the auxiliary storage device for storing secondary copies.

Abstract: Described herein are techniques for better understanding problems arising in an illustrative information management system, such as a data storage management system, and for issuing appropriate alerts and reporting to data management professionals. The illustrative embodiments include a number of features that detect and raise awareness of anomalies in system operations, such as in deduplication pruning operations. Such anomalies can include delays in the processing of archive files to be deleted and/or delays in the generation of the list of archive files to delete. Anomalies are characterized by frequency anomalies and/or by occurrence counts. Utilization is also of interest for certain key system resources, such as deduplication databases, CPU and memory at the storage manager, etc., without limitation.

Abstract: An information management system is disclosed herein that can use artificial intelligence to identify situations in which a performance metric may not be satisfied. For example, a storage manager of the information management system can maintain data related to historical, current, and/or future execution of secondary copy operations by secondary storage computing device(s) in the information management system. Using some or all of this data, the storage manager can train an artificial intelligence model (e.g., a neural network) to classify whether a current or future secondary copy operation job is likely to succeed or fail. Similarly, the storage manager can use some or all of this data to train another artificial intelligence model (e.g., a machine learning model) to predict the length of time for a current or future secondary copy operation job to complete. The trained models can be used to predict whether a performance metric will be satisfied.

Abstract: An improved information management system is described herein that can use artificial intelligence to classify data files (e.g., emails, documents, audio files, video files, etc.) and/or surface in a user interface the classification assigned to the data files. For example, a lightweight training or a heavyweight training can be employed to train classifiers to classify the data files. Use of artificial intelligence to classify data files may reduce the amount of computing resources that the information management system allocates to the data file review process because an auditor may be able to quickly identify those data files that meet the desired criteria using the classification and only request access to those data files. Thus, the information management system may be able to allocate more computing resources to normal or routine tasks, ensuring that such tasks are completed and/or completed in an appropriate amount of time.

Abstract: A system may measure one or more metrics relating to the performance of a job for a set of occurrences of the job with respect to a data set. The measurements may be used to predict a completion time for a subsequent job or phase of the job on the data set. This prediction may be used to present a more accurate indication of a job completion status on the data set. The process may be repeated or performed separately for each client or set of data to provide an individualized progress meter or indicator. Thus, in some cases, variances in the data or computing systems may be reflected in the displayed progress of the job providing for a more accurate indication of job progress.

Abstract: A region-based distributed information management system is described herein in which some or all of the operations typically performed by a centralized storage manager can be distributed to storage managers located in the various geographic regions. These regional storage managers can manage components of the information management system located in their respective geographic region, and communicate with the centralized storage manager (also referred to herein as a “master storage manager”) for synchronization purposes and/or to hand off operations that cannot be performed by the regional storage manager.

Abstract: This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.

Abstract: Described herein are techniques for better understanding problems arising in an illustrative information management system, such as a data storage management system, and for issuing appropriate alerts and reporting to data management professionals. The illustrative embodiments include a number of features that detect and raise awareness of anomalies in system operations, such as in deduplication pruning operations. Such anomalies can include delays in the processing of archive files to be deleted and/or delays in the generation of the list of archive files to delete. Anomalies are characterized by frequency anomalies and/or by occurrence counts. Utilization is also of interest for certain key system resources, such as deduplication databases, CPU and memory at the storage manager, etc., without limitation.

Abstract: Described herein are techniques for better understanding problems arising in an illustrative information management system, such as a data storage management system, and for issuing appropriate alerts and reporting to data management professionals. The illustrative embodiments include a number of features that detect and raise awareness of anomalies in system operations. Categories of interest include events and job anomalies, such as long-running jobs and job success/failure rates. Anomalies are characterized by frequency anomalies and/or by occurrence counts. Utilization is also of interest for certain key system resources, such as deduplication databases, CPU and memory at the storage manager, etc., without limitation. Predicting low utilization periods for these and other key resources is useful for scheduling maintenance activities without interfering with ordinary data protection jobs.

Abstract: Systems, methods, and computer-readable media are disclosed for enhancing an email application to automatically analyze an email thread and generate a compact content summary. The content summary is based on relative content contributions provided by the constituent email messages in the email thread. The content summary may be presented in a special window without disturbing or modifying the email thread or its constituent email messages. The distinctive content summary disclosed herein comprises certain sentences that are automatically gleaned from the email thread, analyzed relative to other sentences, and presented in a chronological sequence so that the user can quickly determine what the email thread is about and/or the current status of the conversation. The content summary is based on email weights, word weights, and intersecting sentence pairs.

Abstract: A region-based distributed information management system is described herein in which some or all of the operations typically performed by a centralized storage manager can be distributed to storage managers located in the various geographic regions. These regional storage managers can manage components of the information management system located in their respective geographic region, and communicate with the centralized storage manager (also referred to herein as a “master storage manager”) for synchronization purposes and/or to hand off operations that cannot be performed by the regional storage manager.

Abstract: A system according to certain aspects improves the process of managing log data. The system may receive a log data file including one or more log lines that contain information relating to computing operations. At least some of the log lines may include a static portion and a variable portion. The system may process a first log line to identify and extract a static portion from the first log line, and determine a first value for the first log line based on the extracted static portion. The system may process a second log line to identify and extract a static portion from the second log line, and determine a second value for the second log line based on the extracted static portion. The system may compare the first and second values, and based on the comparison, organize the first and second log lines together for presentation to a user.