Abstract: System, method, computer program product embodiments and combinations and sub-combinations thereof for replication resynchronization are provided. An embodiment includes providing a mode of operation in a replication control system for repopulating a replicated version of a primary database that does not affect an ability to continue activity in the primary database. Further included is managing the repopulating of the replicated version with attention to at least a resynchronization marker.

Abstract: In a previous storage apparatus, differential JNLs are reflected in order of the update numbers, to the data volumes thereof. If a first storage apparatus is suspended, it is determined which is newer: the update number which the journal recently reflected in a second storage apparatus or the update number reflected in a third storage apparatus. In the newer storage apparatus having the newer update number, it is determined whether one or more JNLs from the journal having the update number next to the update number which is not determined to be the newer to the journal having the update number determined to be the newer exist, or not. If the result of the determination is positive, from the newer storage apparatus to the previous storage apparatus which is not the newer of the second and the third storage apparatuses, one or more differential JNLs are copied.

Abstract: A computer-implemented method for recovering from continuous-data-protection blackouts may include identifying a continuous data protection system configured to copy each change made to a set of data. The computer-implemented method may also include identifying a set of changes made to the set of data but missed by the continuous data protection system. The computer-implemented method may further include identifying an alternate change-tracking system that tracks changes made to the set of data. The computer-implemented method may additionally include updating the continuous data protection system with the missed set of changes as tracked by the alternate change-tracking system. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: In an embodiment, a system and a method of using the system enable an information analyst to use a stand-alone computer-based investigation application to conduct a disconnected investigation on shared database data in a remote location where network access to a shared data repository of the system might be only periodically available, unreliable, or non-existent. In addition, the system and method enable the disconnected investigation to incrementally incorporate ongoing updates made to the shared repository of data, and to periodically publish interim or final results of the disconnected investigation to the shared data repository. A disconnected investigation can be conducted entirely at the disconnected investigation location without having any network connectivity to the shared repository of data.

Abstract: In one embodiment, a user or client device is connected to a distributed file system comprised of one or more physical nodes. The data on each of the physical nodes store metadata about files and directories within the file system. Some of the embodiments permit a user to take a snapshot of data stored on the file system. The snapshot may include a single file, a single directory, a plurality of files within a directory, a plurality of directories, a path on the file system that includes nested files and subdirectories, or more than one path on the file system that each includes nested files and directories. In an embodiment, a snapshot tracking data structure is maintained for efficient creation and deletion of the snapshot.

Abstract: In one general aspect, an apparatus can include a completion identifier configured to identify, for completion processing, a large object (LOB) deleted from an auxiliary table within a DB2 database environment based on a space map record associated with the large object where the auxiliary table functions as an auxiliary space to a base table. The apparatus can also include a completion analyzer configured to identify a resource where an image of the large object is stored at a time before the deletion of the large object from the auxiliary table.

Abstract: In a DBMS, in response to a request from application programs, a base table update function updates a base table and a recovery start point, and a log recording function records update logs for the base table. Then, at predetermined timing, a backup function outputs the content of the base table to a backup file and copies the recovery start point associated with the base table to a recovery start point. Subsequently, when a user has specified a quiesce point and the base table, a copy generation function generates a target table that is a copy of the base table at the quiesce point by updating the backup file of the specified base table with ones of the update logs from the recovery start point to the quiesce point.

Abstract: Techniques are described for providing information about a context that is modeled with multiple context attributes. In some situations, at least some of the context attributes have values used by modules for generating values of other context attributes, and the providing includes determining that a first module is generating a first value of a first of the context attributes of the modeled context and determining that a circular reference exists when it is determined that a module is to generate another value of the first context attribute such that the generating of the another value is caused by the generating of the first value of the first context attribute.

Abstract: A computer storage file system structured without the use of tables or indexes, instead using a sequence of a small but extensible number of predefined Event types in a logical sequence that describes the complete historical state and content of the file system, Events being actions taken upon objects, objects being at least a directory or a file, optionally with associated user data.

Abstract: Techniques for extracting information from a database are provided. A database such as the Web is searched for occurrences of tuples of information. The occurrences of the tuples of information that were found in the database are analyzed to identify a pattern in which the tuples of information were stored. Additional tuples of information can then be extracted from the database utilizing the pattern. This process can be repeated with the additional tuples of information, if desired.

Abstract: Methods, systems, and physical computer storage media are now provided that improve backing up data sets.

Abstract: Query processing statistics are logged in a multi-database system containing a plurality of system databases. A plurality of query log entries generated using information regarding the execution of a plurality of queries are temporarily stored in a database query log (DBQL). The information is received from a plurality of system databases. Each query log entry is generated using information regarding execution of one query by the plurality of system databases. Each query log entry includes a field identifying a system database that was the source of the information in that entry. An express request is created upon occurrence of a triggering event. The express request contains a subset of the query log entries temporarily stored in the DBQL cache. The created express request is transmitted to a plurality of system databases and the contents of the transmitted express request are stored in each of plurality of system databases to which it was transmitted.

Abstract: A cluster manager is configured to manage a plurality of copies of a mid-tier database as a mid-tier database cluster. The cluster manager may concurrently manage a backend database system. The cluster manager is configured to monitor for and react to failures of mid-tier database nodes. The cluster manager may react to a mid-tier database failure by, for example, assigning a new active node, creating a new standby node, creating new copies of the mid-tier databases, implementing new replication or backup schemes, reassigning the node's virtual address to another node, or relocating applications that were directly linked to the mid-tier database to another host. Each node or an associated agent may configure the cluster manager to behave in this fashion during initialization, based on common cluster configuration information. Each copy of the mid-tier database may be, for example, a memory resident database. Thus, a node must reload the entire database into memory to recover a copy of the database.

Abstract: A log consolidation device includes: a selection unit that selects at least part of fields included in multiple logs stored in a storage unit and chronologically representing processes executed by one or multiple processing units, each log including information representing content of a process and a count value relating to the process, the information being divided into multiple fields; a deletion unit that deletes, from at least part of the multiple logs stored in the storage unit, items of information in the fields selected by the selection unit; and an integration unit that integrates into a single log two or more of the multiple logs having identical items of information in fields that were not deleted by the deletion unit by summing up the count values of the two or more of the multiple logs.

Abstract: Disclosed are various embodiments for failover recovery in a distributed data store. A computing device determines whether it is a master data store in a distributed data store. New data item updates are assigned the next transaction identifier in a gapless numbering scheme relative to the most durably persisted entry. New data item updates are also associated with a data store identifier that identifies the new master data store.

Abstract: Disclosed is a method to synchronize the state of an application and an application's objects with data stored on the storage system. The storage system provides API's to create special data, called a marker journal, and stores it on a journal volume. The marker contains application information, e.g. file name, operation on the file, timestamp, etc. Since the journal volume contains markers as well as any changed data in the chronological order, IO activities to the storage system and application activities can be synchronized.

Abstract: The storage system includes a first storage device, configured to be installed in a first site and providing a primary logical volume in which data received from a host computer is written; a second storage device, configured to be installed in a second site and providing a virtual logical volume, which has no structure for storing data received from the first storage system; and a third storage device, configured to be installed in a third site and providing a secondary logical volume in which data received from the second storage system is written. Data written in the primary logical volume of the first storage device are remote-copied to the secondary logical volume of the third storage device via the virtual logical volume of the second storage device.

Abstract: A computer program product, including: a computer readable storage device to store a computer readable program, wherein the computer readable program, when executed by a processor within a computer, causes the computer to perform operations for logging. The operations include: receiving a transaction including data and a log record corresponding to the data; writing the data to a data storage device; and writing the log record to a log space on a persistent memory device coupled to the data storage device.

Abstract: A processing system 10 applies an etching process on a wafer W in a PM1 or PM2. An EC 200 includes functions of a transfer/process control unit 250, a communication unit 255, a log management unit 260, and a backup unit 265, and controls the processing system 10. The transfer/process control unit 250 controls wafer transfer and the etching process. The communication unit 255 transmits to or receives data from each MC 300 and the like. The log management unit 260 registers log information generated at times of the wafer process and transfer, data communication, and the like in log files (in predetermined storage areas of an HDD 215). The backup unit 265 collectively saves the log information stored in the log files in backup files (in other storage areas of the HDD 215), in response to a timing when an unexpected alarm has been generated.

Abstract: In one embodiment of the present invention, a method and system are provided to control access to the non-volatile log (NVlog) of a storage server. By controlling access to the NVLog of a storage server the relative disk write bandwidth available to different client write requests can be controlled. The incoming write request can be categorized, and, during times of heavy load, only be permitted to use NVLog space as permitted based on the categorization of each write request. In one embodiment, the present invention includes receiving a write request from a client at a storage server, and determining whether the received write request can be presently logged in a NVlog based on a category of the write request.

Abstract: A log structured content addressable deduplicated data storage system may be used to store deduplicated data. Data to be stored is partitioned into data segments. Each unique data segment is associated with a label. The storage system maintains a transaction log. Mutating storage operations are initiated by storing transaction records in the transaction log. Additional transaction records are stored in the log when storage operations are completed. Upon restarting an embodiment of the data storage system, the transaction records from the transaction logs are replayed to recreate the state of the data storage system. The data storage system updates file system metadata with transaction information while a storage operation associated with the file is being processed. This transaction information serves as atomically updated transaction commit points, allowing fully internally consistent snapshots of deduplicated volumes to be taken at any time.

Abstract: A method for protecting objects in a computer system against malware is disclosed. An object is analyzed to determine whether it is infected by malware, and if it is determined to be infected, a backup copy of the object is located in a backup of the objects. The infected object is replaced with the backup copy.

Abstract: A disclosed method includes acquiring and a forward log and extracting forward file operations applied to files in an order of applying these from the forward log, specifying generation rules for generating backward file operations with reference to the forward file operations, generating the backward file operations by the specified generation rules and recording these, and applying the forward file operations to the files not having the extracted forward file operations applied and also applying the backward file operations to the files having the forward file operations applied to recover the files not having the forward file operations applied.

Abstract: The local storage performs remote copy to the remote storage. For low traffic failback remote copy, the remote storage performs a delta copy to the local storage, the delta being the difference between the remote storage and local storage. The local storage backs up snapshot data. The remote storage resolves the difference of the snapshot of the local storage and the remote storage. The difference resolution method can take one of several approaches. First, the system informs the timing of snapshot of the local storage to the remote storage and records the accessed area of the data. Second, the system informs the timing of snapshot of the local storage to the remote storage, and the remote storage makes a snapshot and compares the snapshot and remote copied data. Third, the system compares the local data and remote copy data with hashed data.

Abstract: A system and method are provided for auto-committing files of a storage system to immutable status based on a change log of file system activity. The system is configured for producing and analyzing the change log. Producing the change log involves generating change log entries associated with changes made to files of the storage system and organizing the change log entries from the oldest to newest entries. Analyzing the change log involves processing the change log beginning with the oldest entry to determine whether any entries have met the auto-commit time period, and if so, to set the files associated with such entries to immutable status. If a change log entry is found not to have met the auto-commit time period, a resting time period is determined based on the oldest change log entry, and processing of the change log proceeds after expiration of the resting time period.

Abstract: An archival storage cluster of preferably symmetric nodes includes a metadata management system that organizes and provides access to given metadata, preferably in the form of metadata objects. Each metadata object may have a unique name, and metadata objects are organized into regions. Preferably, a region is selected by hashing one or more object attributes (e.g., the object's name) and extracting a given number of bits of the resulting hash value. The number of bits may be controlled by a configuration parameter. Each region is stored redundantly. A region comprises a set of region copies. In particular, there is one authoritative copy of the region, and zero or more backup copies. The number of backup copies may be controlled by a configuration parameter. Region copies are distributed across the nodes of the cluster so as to balance the number of authoritative region copies per node, as well as the number of total region copies per node.

Abstract: The present disclosure is directed to a method for providing continuous data protection for a virtual volume (VV). The method may comprise conceptually dividing the VV into a plurality of same sized chunks; preserving contents of the VV at a specified time; creating a Point in Time (PiT) instance for the VV at the specified time, comprising: a PiT Temporary Virtual Volume (PTVV) for storing modifications to the VV subsequent to the specified time, wherein data stored in the PTVV is prohibited from been overwritten; a re-allocation table for providing read access to a most recent version of each of the plurality of chunks of the VV; and a Continuous Data Protection (CDP) log for providing read access to a historic version of a chunk stored in the PTVV; and updating the PiT instance when a chunk of the plurality of chunks of the VV is being modified.

Abstract: Aspects of the subject matter described herein relate to checkpoints for a file system. In aspects, updates to the file system are organized into checkpoint buckets. When a checkpoint is desired, subsequent updates are directed to another checkpoint bucket. After global tables have been updated for updates in the current checkpoint bucket, a logical copy of the global tables is created. This logical copy is stored as part of the checkpoint data. To assist in recovery, a checkpoint manager may wait until all updates of the current checkpoint bucket have been written to storage before writing final checkpoint data to storage. This final checkpoint data may refer to the logical copy of the global tables and include a validation code to verify that the checkpoint data is correct.

Abstract: A system, a method, and a computer readable media for identifying a user-initiated log file record in a log file are provided. The log file has a user-initiated log file record and a repeating pattern of log file records automatically generated by a software program. The system allows a user to identify first and second timestamp values corresponding to first and second times which identify a time interval of interest in the log file. The system further analyzes the log file to identify the user-initiated log file record having a timestamp value between the first and second timestamp values. The system further identifies the repeating pattern of log file records in the log file.

Abstract: A method of recovering a database includes providing a computer having a processor and providing a backup database including a last change marker. The method also includes extracting, using the processor, the last change marker from the backup database and providing transaction logs. Each transaction of the transaction logs includes input data, processed data, and a change marker. The method further includes sorting, using the processor, the transactions of the transaction logs using the change markers, replaying, using the processor, one or more of the transactions of the transaction logs, and generating a recovered database.

Abstract: Provided is a storage system including: a first interface connected to a host computer; a second interface connected to a manager terminal; a control unit connected to the first interface and the second interface and equipping a processor and a memory; and one or more disk drives in which data that is requested to read by the host computer is stored, in which the control unit detects an access from the host computer to the first interface and an access from the manager terminal to the second interface, and generates log data of operations according to the accesses. Accordingly, log data concerning every action and every operation of the storage system is maintained and stored.

Abstract: Systems for recording, searching, and outputting display information are provided. In some embodiments, systems for recording display information are provided. The systems include a virtual display that: intercepts display-changes describing changes to be made to a state of a display; sends the display-changes to a client for display; records the display-changes; and a context recorder that records context information describing a state of the display derived from a source independently of the display changes and independently of screen-images. In some embodiments, the systems further include a display system that generates an output screen-image based at least in part on at least one of the display-changes and in response to a search of the context information. In some embodiments, the virtual display further records screen-images; and the display system further generates the output screen-image based at least in part on a recorded-screen-image of the recorded screen-images.

Abstract: This disclosure describes, generally, methods and systems for implementing event driven audit logging. The method includes establishing, at an audit logging system, audit logging framework configured to provide application independent connectivity and further configured to provide event driven audit logging. The method further includes receiving, at the audit logging system, a selection of an application to provide event driven auditing, enabling event driven auditing for the selected application, and receiving a selection of event types to enable for auditing by the audit logging framework. Furthermore, the method includes based on the selected event types, tracking the application actions associated with the selected events, creating an event log for the application, and providing access to the event log.

Abstract: Aspects of the subject matter described herein relate to backups and change journals. In aspects, a change journal is read to determine changes that have occurred to objects of a file system. From these changes a data structure is created to capture path information and collect changes for each object. Where the data structure is insufficient to identify a complete path, the live file system is consulted. After the data structure is complete, a data protection engine uses the data structure to update a catalog at least to provide the capability to view the namespace of the protected objects at one or more times covered by the catalog.

Abstract: Various methods and apparatus are described for archiving of an electronic document between multiple interconnected archive units of a distributed server network in geographically-dispersed locations in order to store identical copies of the electronic document at the same time. An archival portal server in the distributed server network sends a five-step, two-phase commit protocol to a selected set of two or more transaction manager instances resident on remote archive units. The archival system reconciles if an error occurs between a start of a transmission of the electronic document and a permanent archiving of that electronic document, or the electronic document is stored in a permanent data storage location within each of the archive units at an end of the two-phase commit protocol making archiving of an electronic document to multiple locations an atomic operation.

Abstract: A system for generating a summary of a plurality of documents and presenting the summary information to a user is provided which includes a computer readable document collection containing a plurality of related documents stored in electronic form. Documents can be pre-processed to group documents into document clusters. The document clusters can also be assigned to predetermined document categories for presentation to a user. A number of multiple document summarization engines are provided which generate summaries for specific classes of multiple documents clusters. A summarizer router is employed to determining a relationship of the documents in a cluster and select one of the document summarization engines for use in generating a summary of the cluster. A single event engine is provided to generate summaries of documents which are closely related temporally and to a specific event.

Abstract: The subject disclosure relates to a database recovery technique that implements various aspects of transaction logging to optimize database recovery performance. Transactions are logged logically with no reference to physical location, which enables logging to be performed via multiple independent log streams in parallel. A set of log streams can further be adjusted to conform to a local configuration of a mirror or secondary node in order to increase mirroring flexibility. Additionally, individual transactions or groups of transactions are recorded using a single log record, which contains timestamp information to enable database recovery without reference to physical checkpoint files. Further, techniques are provided herein for processing transactions without Write Ahead Logging or hardening of undo information.

Abstract: A server auditing process that stores only a single up-to-date data record along with the differences relative to previous changes in the record that allow the user to move “backward in time” to recreate previous values. The auditing feature introduces a baseline database table and a difference database table for each existing database table. The baseline table stores the most recent auditing data and the differences table complements the baseline table by storing pairs in the form of attribute name and previous value. By applying difference rows to baseline data, the user is able to recreate the data as it existed at any given timestamp and at a minimal storage cost. The architecture minimizes the impact of auditing on system performance by employing an asynchronous priority queue so that task processing is deferred until the system has adequate resources and other work is not affected.

Abstract: An image forming apparatus capable of preventing the degradation of performance when the log data is outputted to an external device. An output unit outputs an operation condition about image forming as log data to an external device. A changing unit changes a detailed degree of the log data outputted by the output unit according to a log level that classifies the detailed degrees of the log data into some levels. A setting unit sets up a limit value corresponding to volume of the log data outputted by the output unit. A control unit controls the log level based on the limit value set up by the setting unit.

Abstract: The invention provides a method of managing data updates in DOS-based data storage device having an OTP memory die that includes a code region having a first memory capacity and a code region access resolution and a data region having a second memory capacity and a data region access resolution. The second memory capacity is larger than the first memory capacity and the code region access resolution is finer than the data region access resolution. The method includes chronologically writing a log entry in the code region indicating the change in FAT and root directory for each change in user data written in the data region.

Abstract: A method, article of manufacture, and apparatus for tracking a plurality of objects being stored are disclosed. In an embodiment, this comprises computing the hash value of the name of each object being stored, setting the corresponding bits in a bitmap, and storing the bitmap as a hint in an index. The size of the bitmap is determined by the space available for storing the hint, and the range of hash values is determined by the size of the bitmap. The range may be determined by choosing a prime number smaller than the space available for storing the bitmap. Either the hint or the longest pathname containing the objects can be stored, and this may be selected based on the application.

Abstract: A system and method for improving the efficiency of the transmission of updated blocks generated by logging all the block allocations and deletes as well as CPs and PCPI creation and deletion in a persistent log. The log is scanned during each update cycle (in which changes are transmitted to a destination mirror) by the storage operating system, and only changed blocks that are referenced by the file system as it existed at the end of the update cycle or referenced by PCPIs that existed at the end of the update cycle are actually sent in the transmission. This reduces the number of changes being transmitted.

Abstract: A method, article of manufacture, and apparatus for tracking a plurality of objects being stored are disclosed. In an embodiment, this comprises concatenating at least a portion of the name of each object being stored into a hint; and storing the hint in an index. The portion of the name is the entire name, the first n characters, the last n characters, or every nth character, and this may be selected based on the application associated with the objects. Either the hint or the longest pathname containing the objects can be stored, and this may be selected based on the application.

Abstract: Methods, systems and program products for log-shipping data replication from a primary system to a communicatively-coupled standby system. Embodiments of the invention may receive transactional log data at a standby system, from the primary system, and before the transactional log data is written to storage on the primary system. Embodiments may then receive a notification from the primary system indicating that the corresponding log data was written to storage on the primary system, and responsive to receiving the notification, may process the received transactional log data.

Abstract: Relocating a file system journal within a partitioned memory space is described. In one embodiment, a method, which involves relocating an active file system journal, includes writing the changes for relocating the metadata structures into the new file system journal before the file system journal is activated so that journaling remains active during relocation and the corresponding file system remains consistent throughout the relocation.

Abstract: Methods and systems are disclosed that relate to single instance storage of asset parts utilizing a back reference count associated with each asset part. Entries in a journal associated with the asset parts reflect the intention to increment or decrement an asset part's back reference count. The journal may be used to maintain an accurate and reliable reference count for asset parts replicated across multiple disk drives in a distributed storage system, where the replication is structured to reduce the risk of data loss in the event of a disk drive failure. The journal entries may comprise generation numbers used to maintain a back reference count associated with an asset part and to verify a back reference count associated with an asset part.

Abstract: A storage system maintains a journal and a snapshot of one or more data volumes. Two journal entry types are maintained, an AFTER journal entry and a BEFORE journal entry. Two modes of data recovery are provided: “fast” recovery and “undo-able” recovery. A combination of both recovery modes allows the user to quickly recover a targeted data state.

Abstract: A system for logging database transactions comprises a memory (comprising a direct access storage device) operable to store a database, a database log, and a plurality of log buffers associated with the database log. Each log buffer is operable to store at least one log record associated with a database transaction. The system further comprises a processor operable to log a first record of a first database transaction using the database log and write the database log to the storage device. The processor is further operable to log a second record of a second database transaction in a first of the plurality of log buffers substantially concurrently to the database log being written to the storage device.

Abstract: Various techniques for performing off-host cataloging of backup information are disclosed. One method involves initiating, subsequent to the closure of a backup window, generation of at least a portion of a catalog. The catalog identifies contents of a set of backup information received during the backup window. The generation of the portion of the catalog is performed by a backup computing device and does not involve the host computing device from which the backup information was received. Prior to completion of generation of the catalog, a request to access the catalog is received from a user. In response, information included in the catalog is dynamically displayed to the user.

Abstract: A method, apparatus and program product for classifying objects on a computer system. An audit journal of interactions with objects is evaluated to identify a plurality of logical groups of objects. A graphical construct, such as a hierarchical tree, is created from the plurality of logical groups. And, in response to user input directed to the graphical construct, at least one object is classified based upon a logical group within which the object is arranged.