Abstract: An example operation includes one or more of identifying, by an archiving server node, a unique archival policy for each of a plurality of blockchain nodes, executing, by the archiving server node, a consensus mechanism to determine at least one block from a plurality of blocks of the plurality of the blockchain nodes to be archived, and running the unique archival policy to archive the at least one block from the plurality of the blocks.

Abstract: Described embodiments provide systems and methods for intelligent load balancing of hosted sessions. A processor can determine a plurality of metrics for each of a plurality of machines configured to connect client devices with hosted sessions. The processor can receive, from a client device, a request to establish a connection with one of the plurality of machines to access a hosted session. The processor can determine a score for each of the plurality of machines based at least on the plurality of metrics for each of the plurality of machines. The processor can select a machine from the plurality of machines as a function of the score and a resource cost of the machine. The processor can cause the client device to connect to the selected machine for the hosted session.

Abstract: The present disclosure involves systems, software, and computer implemented methods for intelligent shelfware prediction and system adoption assistance. One example method includes identifying historical shelfware information for software products for customers of a software provider. The historical shelfware information is used to train machine learning models to generate a prediction that indicates a likelihood that a particular product for a particular customer will turn into shelfware. A request is received to generate a shelfware prediction for a first software product for a first customer of the software provider. A first trained machine learning model corresponding to the first software product and the first customer is identified. A first shelfware risk prediction is received from the first trained machine learning model that indicates a likelihood that the first software product turns into shelfware for the first customer. The first shelfware risk prediction is provided in response to the request.

Abstract: A segmentation server generates vulnerability exposure scores associated with workloads operating in a segmented computing environment. The segmentation server may automatically aggregate the vulnerability exposure scores in various ways to generate vulnerability exposure information representative of workloads in an administrative domain controlled by the segmentation server. The aggregated vulnerability exposure information may be presented in a manner that enables an administrator to easily evaluate different segmentation strategies and assess the risks associated with each of them. Moreover, the segmentation server can automatically generate a segmentation policy that modifies a configured segmentation strategy based on the vulnerability exposure scores to reduce exposure to certain vulnerabilities without impeding operation of the workloads.

Abstract: A segmentation server generates vulnerability exposure scores associated with workloads operating in a segmented computing environment. The segmentation server may automatically aggregate the vulnerability exposure scores in various ways to generate vulnerability exposure information representative of workloads in an administrative domain controlled by the segmentation server. The aggregated vulnerability exposure information may be presented in a manner that enables an administrator to easily evaluate different segmentation strategies and assess the risks associated with each of them. Moreover, the segmentation server can automatically generate a segmentation policy that modifies a configured segmentation strategy based on the vulnerability exposure scores to reduce exposure to certain vulnerabilities without impeding operation of the workloads.

Abstract: A command is received from a host regarding accessing an NVMe dispersed namespace in a metro cluster configuration of storage arrays. A namespace group state corresponding to the host and the port is determined and returned to the host. The namespace group state indicates whether the specific communication path between the host and the port is optimized or non-optimized. The namespace group state indicates that the communication path is non-optimized where the host is not located at the same location as the storage array, and that the communication path is optimized where the host is located at the same location as the storage array and the node of the storage array is a preferred node for processing I/O directed to the NVMe dispersed namespace from hosts located in the same location as the storage array.

Abstract: A cannula assembly for treating a puncture site in a subcutaneous vessel includes a cannula and an elongated sleeve with a bore for receiving the cannula. The elongated sleeve includes a plurality of channels circumferentially spaced about the bore through which at least one of a flow of air can be drawn and a plurality of wires can be advanced to promote the formation of a seal between the elongated sleeve and the subcutaneous vessel around the puncture site. The cannula assembly can further include a plug which can be inserted into the bore of the elongated sleeve following removal of the cannula. A needle for insertion into the subcutaneous vessel includes a rigid shaft with an enlarged segment connected to a hub. The needle and cannula assembly can be utilized in a method for cannulating the subcutaneous vessel.

Abstract: A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.

Abstract: A managed server (MS) within an administrative domain is quarantined. The administrative domain includes multiple MSs that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules. The quarantined MS is isolated from other MSs. A description of the MS is modified to indicate that the MS is quarantined, thereby specifying a description of the quarantined MS. Cached actor-sets are updated to indicate the quarantined MS's changed state, thereby specifying updated actor-sets. A determination is made regarding which updated actor-sets are relevant to an other MS, thereby specifying currently-relevant updated actor-sets. A determination is made regarding whether the currently-relevant updated actor-sets differ from actor-sets previously sent to the other MS.

Abstract: A method, computer program product, and computing system for generating, at a first storage appliance of a plurality of storage appliances, a first volume that is configured to be managed by the first storage appliance, wherein data within the first volume is accessible by the first storage appliance. In response to generating the first volume, a protocol identifier representation of the first volume may be generated at each other storage appliance of the plurality of storage appliances and may be configured to be managed by a respective storage appliance of the plurality of storage appliances.

Abstract: Discovery service contact information is provided from a data storage system to administration logic of a virtualization environment, and distributed within the virtualization environment to hypervisor hosts, enabling the hypervisor hosts to discover logical ports within the data storage system, and then establish logical communication paths between the hypervisor hosts and the ports. In response to determining that the data storage system supports virtual volumes, the hypervisor hosts indicate hypervisor capability of using virtual volumes to the data storage system, and the data storage system exposes virtual volumes to hypervisors in response to indications of the ability of those hypervisors to use virtual volumes.

Abstract: In a segmented network environment, a traffic flow graph provides visibility into the connections between workloads or groups of workloads under management of a segmentation policy. Squelching rules may be applied to hide traffic in the traffic flow graph that meets specified criteria. The squelching rules may be label-based rules that enable configuration of squelching rules that apply to group of workloads and enable configurations to be rapidly updated as workloads or added or dropped from the network or as their configurations change. Additionally, squelching rules may be applied based on characteristics of the traffic data or based on an identity of an administrator viewing the traffic flow graph.

Abstract: State information is received from a server indicating an identity of a user logged into the server. An administrative domain wide policy is determined that specifies a relationship between user a group and services or servers accessible to users belonging to the user group. Relevant servers are sent updated management instructions corresponding to rules of the administrative domain wide policy. Such rules provide access to a service or server to users belonging to user groups related to the service. As a result, the servers allow communications that provide access to users based on the specified relationships.

Abstract: A command is received from a host regarding accessing an NVMe dispersed namespace in a metro cluster configuration of storage arrays. A namespace group state corresponding to the host and the port is determined and returned to the host. The namespace group state indicates whether the specific communication path between the host and the port is optimized or non-optimized. The namespace group state indicates that the communication path is non-optimized where the host is not located at the same location as the storage array, and that the communication path is optimized where the host is located at the same location as the storage array and the node of the storage array is a preferred node for processing I/O directed to the NVMe dispersed namespace from hosts located in the same location as the storage array.

Abstract: Discovery service contact information is provided from a data storage system to administration logic of a virtualization environment, and distributed within the virtualization environment to hypervisor hosts, enabling the hypervisor hosts to discover logical ports within the data storage system, and then establish logical communication paths between the hypervisor hosts and the ports. In response to determining that the data storage system supports virtual volumes, the hypervisor hosts indicate hypervisor capability of using virtual volumes to the data storage system, and the data storage system exposes virtual volumes to hypervisors in response to indications of the ability of those hypervisors to use virtual volumes.

Abstract: A segmentation server enables user-based management of a segmentation policy. Administrators belonging to different user groups may have different limited visibility into traffic flows controlled by the segmentation policy and may be assigned different privileges with respect to viewing, creating, and modifying rules of the segmentation policy. Thus, the burden of administering the segmentation policy may be distributed between administrators associated with different user groups that each may have responsibility for a different segment.

Abstract: A method, computer program product, and computing system for generating, at a first storage appliance of a plurality of storage appliances, a first volume that is configured to be managed by the first storage appliance, wherein data within the first volume is accessible by the first storage appliance. In response to generating the first volume, a protocol identifier representation of the first volume may be generated at each other storage appliance of the plurality of storage appliances and may be configured to be managed by a respective storage appliance of the plurality of storage appliances.

Abstract: A method, computer program product, and computing system for defining a vVol NVMe subsystem for a plurality of vVol NVMe namespaces within a storage system; and enabling an Asymmetric Namespace Access (ANA) group that aggregates two or more vVol NVMe namespaces defined within the plurality of vVol NVMe namespaces and communicates ANA group information in-band, thus eliminating the need for out-of-band communication of vVol protocol endpoint information.

Abstract: An enforcement module receives a DNS-based rule of a segmentation policy that controls access of a managed workload to workloads in a DNS domain in which the IP addresses of the workloads associated with a domain name are resolved by a DNS server. When the managed workload makes a connection request to the workload associated with the domain name, the enforcement module snoops on a DNS response from the DNS server to learn the IP address of the workload associated with the domain name. If a domain name of the DNS domain is in a whitelist of domain names permitted by the DNS-based rule, the enforcement module adds the learned IP address to a whitelist of IP addresses and configures a firewall associated with the managed workload to permit connections to the IP addresses in the whitelist.

Abstract: A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.