Network Appliance, Inc.

Netapp, Inc.

Mark Muhlestein

Gaurav Banga

Wesley R Witte

Mark Smith

Kayuri Hasmukh Patel

David Noveck

Thomas Haynes

Tim Thompson

David Hitz

Timothy J Thompson

Robert M Armitano

Kumar Murugesan

Andrea Borr

Alan G Yoder

Robert Hawley

Amit Aggarwal

Sunil Bhargo

Dejan L Mihajlovic

Amrutha Ks

Mankawaldeep Singh

James T Uren

Joan Pearson

Mankawal Deep Singh

Rajesh Jaiswal

One or more techniques and/or systems are provided for implementing storage level access control for data grouping structures. For example, a storage level access guard may be defined for a data grouping structure (e.g., a Qtree, a portion of a volume, etc.) of a storage device. The storage level access guard may be defined at a storage level of the storage device such that clients and/or certain administrators such as domain administrators may be restricted from accessing and/or changing the storage level access guard, which may increase data security. A hidden and unmodifiable property may be applied to the storage level access guard, which may be stored in a directory associated with the data grouping structure so that a logical replication of the data grouping structure may also replicate the storage level access guard.

Storage level access control for data grouping structures

Techniques for dynamic throttling of scan requests for multiple scanners in a cluster of nodes are described. An apparatus may comprise a dynamic throttling service component for executing the dynamic throttling of scan requests for the multiple scanners in the cluster of nodes. The dynamic throttling service component operative to estimate, by the scanner proxy, a resource limit count value representative of resource capacity for servicing scan requests for each one of the multiple scanners in the cluster of nodes; detect a first scan request exceeds the resource limit count value for a first scanner; dynamically throttle each subsequent scan request for the first scanner in response to the first scan request exceeding the resource limit count value; and revise the resource limit count value, by the scanner proxy, for the first scanner.

Dynamic throttling of scan requests for multiple scanners a cluster of nodes

Techniques for maintaining dynamic configuration information of a multi-host off-cluster service on a cluster are described. An apparatus may comprise a dynamic configuration validation service component to execute to execute a dynamic configuration validation service for scanning files in a cluster of nodes. The dynamic configuration validation service component operative to validate a scanner version for each one of multiple scanners for scanning a file in a cluster of nodes, maintain the scanner version in a list of valid scanner versions for the multiple scanners, and scan the file by one of the one of multiple scanners having the scanner version contained in the list of the valid scanner versions.

Maintaining dynamic configuration information of a multi-host off-cluster service on a cluster

A method for operating a server first assigns a plurality of storage volumes to one or more storage devices. A plurality of sub-volumes is established within a namespace of each of the plurality of storage volumes. An instance of a virtual server is created, the virtual server having a plurality of assigned sub-volumes, the assigned sub-volumes chosen from different storage volumes of the plurality of storage volumes. A file system function is shared between the server and the instance of the virtual server, the file system function using at least one of the plurality of assigned sub-volumes.

Method and apparatus for encapsulating a virtual filer on a filer

A storage system, such as a file server, uses pathname aliasing and exports a stored resource to clients by advertising to the clients a different pathname than the actual pathname of the resource.

Aliasing of exported paths in a storage system

A system and method enables gradual transitioning of a server, such as a filer, to a new security domain and/or IP address scheme. A single physical platform may comprise multiple logical servers, such as virtual filers (vfilers), that simultaneously participate in different security domains and IP address schemes. Each logical server is allocated its own set of storage resources, such as volumes and qtrees, and network resources, such as network addresses. Additionally, a common set of storage resources may store a data set that is accessible to logical servers that participate in the different security domains and/or IP address schemes. Therefore, the server can transition from an old security domain to a new, e.g., upgraded, security domain, by gradually phasing out file access requests sent to a logical server in the old domain and redirecting those requests to a logical server in the new security domain. Similarly, the server can transition from an old IP address scheme to a new IP address scheme by gradually redirecting file access requests from one logical server to another. Since the invention enables multiple logical servers to access the server's data set, clients do not experience any downtime in service during the server's transition to a new security domain and/or IP address scheme.

Virtual filer and IP space based IT configuration transitioning framework

A method and apparatus for operating a computer data storage system is disclosed. A computer data storage system is administered by a physical server administrator. The physical server administrator administers the computer data storage system with a full administrative capability. The physical server administrator creates one or more virtual servers, each virtual server administrated by a virtual server administrator. Each virtual server administrator has a designated subset of the full administrative capability for administrating the virtual server.

System and method for administering a filer having a plurality of virtual filers

A technique efficiently creates and serves a backup data set on a backup filer located at a remote site from a primary filer by essentially moving an entire operating environment of a primary data set to the backup filer. The primary filer is organized into one or more virtual filers (vfilers), one of which (the primary vfiler) is configured to serve data, such as the primary data set, for a client. In the event that the primary filer or primary vfiler becomes unavailable, the technique may be implemented as a disaster recovery or data migration sequence to enable efficient instantiation of a backup vfiler to serve the backup data set for the client.

Remote disaster recovery and data migration using virtual appliance migration

Certain tasks are outsourced from a filer to a remote policy engine. The policy engine implements various defined policies to control the filer's servicing of client requests. For example, the policy engine can be used to implement policies to control various storage-related operations relating to data managed by a filer, such as creation, deletion, modification, opening, closing, renaming and/or changing attributes of files or directories managed by the filer.

Policy engine to control the servicing of requests received by a storage server

An architecture provides the ability to create and maintain multiple instances of virtual servers, such as virtual filers (vfilers), within a server, such as a filer. A vfiler is a logical partitioning of network and storage resources of the filer platform to establish an instance of a multi-protocol server. Each vfiler is allocated a subset of dedicated units of storage resources, such as volumes or logical sub-volumes (qtrees), and one or more network address resources. Each vfiler is also allowed shared access to a file system resource of a storage operating system. To ensure controlled access to the allocated and shared resources, each vfiler is further assigned its own security domain for each access protocol. A vfiler boundary check is performed by the file system to verify that a current vfiler is allowed to access certain storage resources for a requested file stored on the filer platform.

Method and apparatus for allocating resources among virtual filers on a filer

A file server that provides for backup and restore of files in a heterogeneous file server environment. Metadata associated with each file by each model or protocol is preserved across backup and restore operations. The file server performs at least three tasks as part of the backup and restore operations. The file server notes all file attributes associated with each file in either model. These file attributes can include Unix perms, ownership and timestamp information, and link information. On backup, the file server records those file attributes in an analogous record using a different model. The file server records each element of Unix metadata as an NT Extended Attribute for use by an NT backup element. On restore, the file server restores those file attributes from the analogous record. The NT Extended Attributes provided by an NT restore element are translated into Unix metadata. The file server provides an element for translating between Unix metadata and NT Extended Attributes transparently to the NT backup and restore elements, so that NT backup and restore elements that were created without reference to the heterogeneous file server environment can be used.

Backup and restore for heterogeneous file server environment

The invention provides a method and system for performing specialized services for files at a server, such as scanning files for viruses. A filer or other server is connected to one or more supplementary computing devices that scan requested files to ensure they are virus free prior to delivery to end users. When an end user requests a file the following steps occur: The server determines whether the file requested must be scanned before delivery to the end user. The server opens a channel to one of the external computing devices and sends the filename. The external computing device opens the file and scans it. The external computing device notifies the filer the results of the file scan operation. The server sends the file to the end user provided the status indicates it may do so.

Decentralized virus scanning for stored data

A method for enabling a server configured with a plurality of virtual servers to participate in a plurality of private network address spaces and service requests within those address spaces is disclosed. Each virtual server is associated with an IPspace. Each network interface is tagged with an IPspace identifier (ID). Each virtual server is provided with one or more routing tables that control routing operations for requests processed by the virtual server. The IPspace ID is applied to translation procedures that enable selection of a virtual server to process an incoming request, and an appropriate routing table used to process an outgoing request.

Growing community of inventors

Tuscon, AZ, United States of America

Mark Muhlestein