Abstract: A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.

Abstract: Methods and systems for a networked storage system are provided. One method includes predicting an IOPS limit for a plurality of storage pools based on a maximum allowed latency of each storage pool, the maximum allowed latency determined from a relationship between the retrieved latency and a total number of IOPS from a resource data structure; identifying a storage pool whose utilization has reached a threshold value, the utilization based on a total number of IOPS directed towards the storage pool and a predicted IOPS limit; detecting a bully workload based on a numerical value determined from a total number of IOPS issued by the bully workload for the storage pool and a rising step function; and implementing a corrective action to reduce an impact of the bully workload on a victim workload.

Abstract: Methods and systems for a networked storage system are provided. One method includes predicting an IOPS limit for a plurality of storage pools based on a maximum allowed latency of each storage pool, the maximum allowed latency determined from a relationship between the retrieved latency and a total number of IOPS from a resource data structure; identifying a storage pool whose utilization has reached a threshold value, the utilization based on a total number of IOPS directed towards the storage pool and a predicted IOPS limit; detecting a bully workload based on a numerical value determined from a total number of IOPS issued by the bully workload for the storage pool and a rising step function; and implementing a corrective action to reduce an impact of the bully workload on a victim workload.

Abstract: Methods and systems for a networked storage system are provided. One method includes predicting an IOPS limit for a plurality of storage pools based on a maximum allowed latency of each storage pool, the maximum allowed latency determined from a relationship between the retrieved latency and a total number of IOPS from a resource data structure; identifying a storage pool whose utilization has reached a threshold value, the utilization based on a total number of IOPS directed towards the storage pool and a predicted IOPS limit; detecting a bully workload based on a numerical value determined from a total number of IOPS issued by the bully workload for the storage pool and a rising step function; and implementing a corrective action to reduce an impact of the bully workload on a victim workload.

Abstract: A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.

Abstract: A system, method, and machine-readable storage medium for resolving a candidate community are provided. In some embodiments, a method includes obtaining a candidate community and a neighbor set for the candidate community, the neighbor set including zero or more stable communities. The method also includes resolving the candidate community as being a new stable community if the neighbor set is empty. The method further includes resolving the candidate community as being part of a matching stable community if a hash value of the candidate community matches a hash value of one or more stable communities included in the neighbor set. The method also includes resolving the candidate community as being a new stable community if an entropy value is greater than a threshold, the entropy value being based on the candidate community and the neighbor set.

Abstract: A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.

Abstract: A system, method, and machine-readable storage medium for resolving a candidate community are provided. In some embodiments, a method includes obtaining a candidate community and a neighbor set for the candidate community, the neighbor set including zero or more stable communities. The method also includes resolving the candidate community as being a new stable community if the neighbor set is empty. The method further includes resolving the candidate community as being part of a matching stable community if a hash value of the candidate community matches a hash value of one or more stable communities included in the neighbor set. The method also includes resolving the candidate community as being a new stable community if an entropy value is greater than a threshold, the entropy value being based on the candidate community and the neighbor set.

Abstract: A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.

Abstract: A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.

Abstract: An example system and method to provide a dashboard for users to analyze and review their hyper-scaler usage and spending and offer optimizations to predict optimal use of reserved and unreserved instances on various hyper-scaler platforms. While hyper-scaler platforms offer flexibility for users to scale their use on a platform, there is a potential risk of rapid cost overruns in large enterprise organizations that may be difficult to control and predict. In some examples, the system can determine an optimal number of reserved instances using past usage data and/or prediction data from a user may be used by the system to make forward predictions about reserving an optimal number of instances and minimizing hyper-scaler resource use.

Abstract: An example system and method to provide a dashboard for users to analyze and review their hyper-scaler usage and spending and offer optimizations to predict optimal use of reserved and unreserved instances on various hyper-scaler platforms. While hyper-scaler platforms offer flexibility for users to scale their use on a platform, there is a potential risk of rapid cost overruns in large enterprise organizations that may be difficult to control and predict. In some examples, the system can determine an optimal number of reserved instances using past usage data and/or prediction data from a user may be used by the system to make forward predictions about reserving an optimal number of instances and minimizing hyper-scaler resource use.

Abstract: Methods and systems for a networked storage environment are provided. One method includes mirroring a plurality of requests from a switch and transmitting the mirrored plurality of requests to a remote acquisition unit; extracting application layer protocol data units from assembled transport layer packets; parsing the application layer protocol data units to obtain file system requests; identifying storage volume identifiers from the parsed file system requests that are associated with a greatest number of operations; identifying network addresses for client systems initiating the greatest number of operations for the storage volumes and network addresses of target storage systems managing the storage volumes; and providing a total number of operations for the plurality of requests in a given time, the identified storage volume identifiers, the network addresses of the client systems and the network addresses of the target storage systems to a management console.

Abstract: A system, method, and machine-readable storage medium for resolving a candidate community are provided. In some embodiments, a method includes obtaining a candidate community and a neighbor set for the candidate community, the neighbor set including zero or more stable communities. The method also includes resolving the candidate community as being a new stable community if the neighbor set is empty. The method further includes resolving the candidate community as being part of a matching stable community if a hash value of the candidate community matches a hash value of one or more stable communities included in the neighbor set. The method also includes resolving the candidate community as being a new stable community if an entropy value is greater than a threshold, the entropy value being based on the candidate community and the neighbor set.

Abstract: A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.

Abstract: A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.

Abstract: Methods and systems for a networked storage environment are provided. An application executed by a computing device using a plurality of resources in a networked storage environment for storing and retrieving application data is identified. Performance data of the plurality of resources is collected and historical performance data is retrieved. The collected and historical performance data for the plurality of resources is used to determine an overall anomaly score for the application indicating behavior of the application over time and individual anomaly scores for each resource with an indicator highlighting behavior of a resource that impacts the overall anomaly score for the application.

Abstract: Methods and systems for a networked storage environment are provided. One method includes mirroring a plurality of requests from a switch and transmitting the mirrored plurality of requests to a remote acquisition unit; extracting application layer protocol data units from assembled transport layer packets; parsing the application layer protocol data units to obtain file system requests; identifying storage volume identifiers from the parsed file system requests that are associated with a greatest number of operations; identifying network addresses for client systems initiating the greatest number of operations for the storage volumes and network addresses of target storage systems managing the storage volumes; and providing a total number of operations for the plurality of requests in a given time, the identified storage volume identifiers, the network addresses of the client systems and the network addresses of the target storage systems to a management console.

Abstract: Methods and systems for a networked storage environment are provided. One method includes mirroring a plurality of requests from a switch and transmitting the mirrored plurality of requests to a remote acquisition unit; extracting application layer protocol data units from assembled transport layer packets; parsing the application layer protocol data units to obtain file system requests; identifying storage volume identifiers from the parsed file system requests that are associated with a greatest number of operations; identifying network addresses for client systems initiating the greatest number of operations for the storage volumes and network addresses of target storage systems managing the storage volumes; and providing a total number of operations for the plurality of requests in a given time, the identified storage volume identifiers, the network addresses of the client systems and the network addresses of the target storage systems to a management console.

Abstract: Methods and systems for a networked storage environment are provided. One method includes mirroring a plurality of requests from a switch and transmitting the mirrored plurality of requests to a remote acquisition unit; extracting application layer protocol data units from assembled transport layer packets; parsing the application layer protocol data units to obtain file system requests; identifying storage volume identifiers from the parsed file system requests that are associated with a greatest number of operations; identifying network addresses for client systems initiating the greatest number of operations for the storage volumes and network addresses of target storage systems managing the storage volumes; and providing a total number of operations for the plurality of requests in a given time, the identified storage volume identifiers, the network addresses of the client systems and the network addresses of the target storage systems to a management console.