Comm Vault Systems, Inc.

Mrityunjay Upadhyay

Anand Vibhor

Bhavyan Bharatkumar Mehta

Marcelo Dos Reis Mansano

Rajiv Kottomtharayil

Divakar Radhakrishnan

Shree Nandhini Santhakumar

Madhusudhanan Natarajan

Amey Vijaykumar Karandikar

Sri Karthik Bhagi

Pavan Kumar Reddy Bedadala

PurnaChandra Sekhar Bedhapudi

Pratima Laxman Gadhave

Shyam Sundar Ramkumar

Deepak Raghunath Attarde

Arun Prasad Amarendran

Amit Bhaskar Ausarkar

Suraj Bharech

Purnachandra Sekhar Bedhapudi

Jagadeesh Narayanan Kallidaikurichi Swaminathan

An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Detecting ransomware in monitored data

An illustrative data storage management system uses a control layer that controls information content presented to users and ensures information privacy between diverse tenants and/or resellers who share the system. The system populates a relationship database as transactions roll in (intake processing), and uses information in the relationship database later when processing responses (output processing). The relationship database comprises associations between e.g., a company ID and any number of entities that were created by or on behalf of the company or that are related to the company's service in the system. The control layer parses raw results that are responsive to requests for information and prevents others' information from being included in the responsive message(s). The techniques disclosed herein are not limited to shared systems managed by service providers, and may be implemented in fully owned and operated systems to add security and privacy among diverse users and/or departments.

Controlling information privacy in a shared data storage management system

Described herein are techniques for automating media agent state management. For example, if a media agent is running poorly, then the media agent can be disabled and an alternate media agent can perform secondary copy job operations in place of the poorly running media agent. To determine whether a media agent is running poorly, a storage manager can determine whether the media agent has an anomalous number of failed jobs, pending jobs, and/or long running jobs and/or can determine whether the amount of resources used by the media agent is high or is increasing constantly, at a constant rate, or at a near constant rate.

Automated media agent state management

This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.

Ransomware detection and data pruning management

Detecting ransomware in secondary copies of client computing devices

Described herein are techniques for better understanding problems arising in an illustrative information management system, such as a data storage management system, and for issuing appropriate alerts and reporting to data management professionals. The illustrative embodiments include a number of features that detect and raise awareness of anomalies in system operations, such as in deduplication pruning operations. Such anomalies can include delays in the processing of archive files to be deleted and/or delays in the generation of the list of archive files to delete. Anomalies are characterized by frequency anomalies and/or by occurrence counts. Utilization is also of interest for certain key system resources, such as deduplication databases, CPU and memory at the storage manager, etc., without limitation. Predicting low utilization periods for these and other key resources is useful for scheduling maintenance activities without interfering with ordinary deduplication pruning operations and/or other data protection jobs.

Anomaly detection in deduplication pruning operations

An illustrative data storage management system comprises 'awareness logic' that executes on computing devices hosting storage management components such as storage manager, data agent, media agent, and/or other storage management applications. The illustrative awareness logic operates within each of these illustrative components, e.g., as a thread within processes of the storage management component, such as storage management core process, file identifier process, log monitoring process, etc. The awareness logic monitors the targeted process over time and triggers remedial action when criteria are met. Certain vital statistics of each process are collected periodically and analyzed by the illustrative awareness logic, such as CPU usage, memory usage, and handle counts. Criteria for corrective action include rising trends based on local minima data points for one or more vital statistics of the process. Other criteria include exceeding a threshold based on a logarithm function of the collected data points.

Remedial action based on maintaining process awareness in data storage management

A system or method for managing an auxiliary data location and a secondary data location. A client computing device may have secondary copies of its primary data stored at a secondary storage device, as well as auxiliary copies of the secondary copies at an auxiliary storage device. The client computing device may move from one geographic location that is near the secondary storage device to a second geographic location that is far from the secondary storage device, but closer to the auxiliary storage device. A method is provided with input signals in response to the move, and outputs a probability value that the move is temporary or permanent. Based on the output, a storage manager that manages the client computing device may then direct the client computing device to use the auxiliary storage device for storing secondary copies.

Geo-location-based data replication

A client computing device receives a behavior model corresponding to a user group associated with a user. The behavior model has been trained with monitored user interactions of one or more files associated with the user group. The client computing device further mounts a snapshot of a file and determines, based on the behavior model, which files of the mounted snapshot to transfer to a locally accessible cache. During use of the client computing device, the client computing device may determine whether the mounted snapshot is accessible. If the mounted snapshot is not accessible, the client computing device may selectively delete, based on the behavior model, one or more of the files stored in the locally accessible cache. If the mounted snapshot is accessible, the client computing device may update the one or more files of the locally accessible cache with monitored user interactions with the mounted snapshot.

Intelligent cache management for mounted snapshots based on a behavior model

A system may measure one or more metrics relating to the performance of a job for a set of occurrences of the job with respect to a data set. The measurements may be used to predict a completion time for a subsequent job or phase of the job on the data set. This prediction may be used to present a more accurate indication of a job completion status on the data set. The process may be repeated or performed separately for each client or set of data to provide an individualized progress meter or indicator. Thus, in some cases, variances in the data or computing systems may be reflected in the displayed progress of the job providing for a more accurate indication of job progress.

Dynamic computing progress tracker

An improved information management system is described herein that can use artificial intelligence to classify data files (e.g., emails, documents, audio files, video files, etc.) and/or surface in a user interface the classification assigned to the data files. For example, a lightweight training or a heavyweight training can be employed to train classifiers to classify the data files. Use of artificial intelligence to classify data files may reduce the amount of computing resources that the information management system allocates to the data file review process because an auditor may be able to quickly identify those data files that meet the desired criteria using the classification and only request access to those data files. Thus, the information management system may be able to allocate more computing resources to normal or routine tasks, ensuring that such tasks are completed and/or completed in an appropriate amount of time.

Automated email classification in an information management system

Systems, methods, and computer-readable media are disclosed for enhancing an email application to automatically analyze an email thread and generate a compact content summary. The content summary is based on relative content contributions provided by the constituent email messages in the email thread. The content summary may be presented in a special window without disturbing or modifying the email thread or its constituent email messages. The distinctive content summary disclosed herein comprises certain sentences that are automatically gleaned from the email thread, analyzed relative to other sentences, and presented in a chronological sequence so that the user can quickly determine what the email thread is about and/or the current status of the conversation. The content summary is based on email weights, word weights, and intersecting sentence pairs.

Summarization and processing of email on a client computing device based on content contribution to an email thread using weighting techniques

A system according to certain aspects improves the process of managing log data. The system may receive a log data file including one or more log lines that contain information relating to computing operations. At least some of the log lines may include a static portion and a variable portion. The system may process a first log line to identify and extract a static portion from the first log line, and determine a first value for the first log line based on the extracted static portion. The system may process a second log line to identify and extract a static portion from the second log line, and determine a second value for the second log line based on the extracted static portion. The system may compare the first and second values, and based on the comparison, organize the first and second log lines together for presentation to a user.

Growing community of inventors

Hyderabad Telangana, India

Mrityunjay Upadhyay