Emc Corporation

Emc IP Holding Company LLC

Boris Farizon

Anoop George Ninan

Samuil Shmuylovich

Svetlana Patsenker

Keith Alan Carson, Jr

Mordechai Zvi Zur

Benjamin Thrift

Eugenio Korolev

Rajesh Gandhi

Evgeny Roytman

Ilya Liubovich

John P Sheehy, Jr

Nigel B Hislop

Dongjun Sun

Charuta Vijaykumar Apte

Venkata R Tiruveedi

Ohad Zeliger

Sylvia Martin

Gregory MacKinnon

Terrence Lewis

Paul Clark

Thomas Demay

Robert Anthony Lincourt, Jr

Eric Young

Ethan D Roberts

Jeffrey Louis Alexander

Paul Bradley

Yevgeniy Motov

Valery Altman

Christopher M Barrett

Eric Baize

Stephen Walsh

Min Yin

Urayoan Irizarry

Wesley A Scott

Steven M Stramaglia

Yogesh Athawale

Aleksandra A Messier

Jeffrey B Lee

Rajesh K Gandi

Pramod Kulyadi Pai

John Young

Venkat R Tiruveedi

A method, apparatus and computer program product for handling secure information (e.g., a password, an account number, a personal identification number (PIN), a user identifier, an encryption key, and a path where said secure information is stored) is presented. Secure information is stored in a software container. A plurality of representations of the secure information is provided, each of the plurality of representations for use under different conditions. Dependent on the particular condition, at least one of the plurality of representations of the secure information is provided by the container. The container holds the secure information during all stages of processing in a manner that prevents unauthorized parties from gaining access to the secret in clear form.

Method and apparatus providing a framework for secure information lifecycle

Techniques disclosed herein describe a data retrieval process for storing management data from a network environment using an efficient polling-based approach without sacrificing the real-time aspect of data retrieval that a push model provides. The process is highly scalable and reliable, and is useful in Network Address Translation (NAT) environments because the number of holes in a NAT firewall is minimized. The data retrieval component uses intelligent polling to retrieve data and store the data in a central database without overloading the system. A data retrieval component polls a data collection agent for a dataset. The data collection agent transfers the data set and a poll indication of when a subsequent data set will be ready for transfer. Subsequent polling is based on a processor load at a data retrieval component.

Intelligent, scalable, low-overhead mechanism for data retrieval in a distributed network environment

A SAN management agent computes a validator corresponding to a full data set from which a relative (change) data set is derived. The validator, such as a checksum, identifies the full data set to which the relative data set is applicable. The validator is transmitted with the relative data set, and the store process compares the validator with the previous validator stored with the full data set in a database. If the validators correspond (i.e. match), then the received relative data set is applicable to the full data set stored at the database, and the relative data set may be processed as a change set. The remote agent therefore computes the validator on a full data set at a remote node, and transmits the validator with the change set. Subsequent relative data sets may then compare the current validator of the DB data set with the validator from which the relative set was derived.

Methods and apparatus for persisting management information changes

Data structures, methods, and apparatus useful in configuring agent services operating in a storage area network are provided. The data structures may include a list of agent types for which agent services are configurable for operation by agents of those agent types in a storage area network; for each agent type in the list of agent types, a corresponding list of configurable agent services operable by agents of the agent type; for each configurable agent service in each list of configurable agent services, a corresponding list of configurable parameters for the configurable agent service; and for each configurable parameter in each list of configurable parameters, at least one parameter value associated with the configurable parameter. Procedures and apparatus are provided for configuring agent services by updating elements of the data structures and providing the updated elements to the agent services.

Configuring agent services operable by agents in a storage area network

A storage area network management application operates using agents for management of resources. Authenticity is verified in installing an agent on a host computer system in the storage area network. A file is identified for use in installing the agent. The file is signed to produce a digital signature for the file. A certificate is sent to a recipient for use in verifying authenticity of information. The file and digital signature are sent to the recipient. At the recipient, the certificate and the digital signature are used to verify the file. An agent installation operation is performed, using the file, to install the agent on the host computer system.

Verifying authenticity in data storage management systems

In a storage area network, agents provide transactions of data sets containing updates to manageable entities in a SAN. A SAN server avoids intermittent dissemination of events pertaining to a single transaction by storing events in a cache until completion of all subtransactions in the transaction, and then disseminating all events pertaining to the transaction. Transactions are broken down into update sections, each containing one or more subtransactions collectively defining the entire transaction. Update sections corresponding to the transaction are tagged with a section ID. Events indicating completion of processing of the update section are identified by the section ID, and suppressed temporarily by storing them in the event cache pending completion of the transaction. Other events not matching a tagged section ID are allowed to disseminate. Upon completion of the transaction, events for all section IDs corresponding to the transaction are disseminated from the cache.

Methods and apparatus for processing partitioned changes

A method and apparatus for managing a transaction in a storage area network is presented. A request is received from an agent process at a management server. The management server provides a ticket relating to the request. The ticket is sent to the agent process. The management server identifies a storage process related to the ticket. The storage process contacts the agent process and receives the information from the agent process.

Transaction lifecycle management in distributed management systems

A system determines status of agent execution of a command in a network. The system identifies a command to be performed by an agent and issues the command to the agent for execution. The agent operates a status manager that tracks execution status of commands in the agent. The system sends status requests to the agent to determine a status of execution of the command by the agent and the agent responds and sends a status response indicating the status of the execution of the command by the agent. Applications are thus provided with current status of execution of long running commands in an agent.

Method and apparatus for obtaining agent status in a network management application

A system receives, from an agent, an agent timestamp associated with a production of a collection of data. The system creates a history associated with the collection of data and the agent timestamp. The system receives an indication that processing the collection of data is complete, and associates the collection of data and the agent timestamp with at least one resource referenced within the collection of data.

Methods and apparatus for capturing last discovery time of managed objects

A log collection utility (LCU) operable in a storage area network (SAN) to identify the various types of log files generated in the SAN computes the location of each of the log files, and collects the log files for consolidation and analysis in a common repository. The LCU periodically collects and/or processes the log files by enumerating the location of each of the log files in a log file designator, and generates a script operable for identifying each of the log files sought. A resulting task definition file lists each of the log files identified. The log collection utility therefore finds log files generated by dissimilar applications and nodes in the SAN via a log type definition that enumerates each of the log files in a manner that is agnostic to operating systems, platforms, and directory structures around which the log files are written and stored.

Methods and apparatus for locating network logs

Techniques for locating and collecting application logs are disclosed. Embodiments disclosed herein can be advantageously utilized to collect application logs from a plurality of computers in a network. For example, embodiments disclosed herein can be used to identify and collect application logs from a plurality of host computers in a storage area network.

Collecting application logs

A storage area network (SAN) license validator manages data collection policies (DCPs) in deployed SAN agents by identifying data collection policies corresponding to unlicensed features, and disabling the DCPs for the unlicensed features. Thus, the agents need not expend computational and memory resources to gather data for unlicensed features that will not be queried. Agents receive a set of data collection policies (DCPs) for licensed features for which the corresponding data will be gathered and reported to the MODB. DCPs for unlicensed features are disabled in the agents that would have executed them, either by removing or canceling from an active DCP list or by omitting the unlicensed DCPs from the startup sequence of the agent. In this manner, agents operate with only the DCPs for licensed products and corresponding features, and need not gather extraneous data. Users do not observe a designated unavailable screen icon or selection, as unavailable data selections are simply omitted from the GUI display.

Software license enforcement by runtime feature enablement

In a storage area network (SAN), a SAN management application provides a security audit log of security sensitive user actions performed across the storage area network. In a SAN, multiple services operate to perform requested user actions. Configurations herein substantially overcome the shortcomings of conventional SAN security event logging by providing a comprehensive security audit mechanism operable to identify and record user actions. An event normalizer disposed in each of the services identifies requested user actions, creates a uniform user action object, and sends the user action object to a coalescer operable to receive user action objects from the plurality of services in the SAN. The user action object provides a generic template responsive to each of the event normalizers in the services. The event normalizers normalize event properties and attributes concerning a user action into the generic user action object, and employs preexisting conduits for gathering and recording events.

User action security auditing

A SAN management agent performs hierarchical based partitioning. Partitions expressed as a hierarchy of related manageable entities allow partitioning based on the relations in the hierarchy. Related manageable entities often trigger updates to database elements common to both of the related manageable entities. The related manageable entities often take the form of a hierarchy (tree) indicative of these relations. Grouping the updates affecting related manageable entities together in the same partition allows the database elements affected by the related updates to occur from a single retrieval of the common database element. By partitioning updates of related manageable entities together, the common database elements are more likely to be paged or cached in memory at the time the update processing updates the common database element. Accordingly, tree-based partitioning identifies relations between manageable entities, and designates related manageable entities by traversing the relations.

Methods and apparatus for structured partitioning of management information

A system receives notification from an agent of that agent's availability for data collection from resources within a network. The system identifies, from the notification, a version value associated with the agent. The system determines, from the version value, a set of operations to be assigned to the agent that will be compatible with that agent, and assigns a subset of the set of operations to the agent to enable that agent to collect data from resources in the network.

Methods and apparatus assigning operations to agents based on versions

Growing community of inventors

Westborough, MA, United States of America

Boris Farizon