Nutanix, Inc.

Pankaj Kumar Sinha

Sagar Gupta

Ketan Kotwal

Deepak Tripathi

Manoj Premanand Naik

Durga Mahesh Arikatla

Kalpesh Ashok Bafna

Yifeng Huang

Pradeep Thomas

Yugank Dubey

Partha Pratim Nayak

Examples of file analytics systems are described that may obtain metadata data from a virtualized file server using a snapshot of the file virtualized file. The analytics system may mount a snapshot to retrieve metadata used in determining an overall size, structure, owner, permissions, and/or storage locations of parts of a file system managed by the virtualized file server. The analytics tool may communicate directly with each of file server virtual machines of the virtualized file server during the metadata collection process to retrieve the respective portions of the metadata. During the metadata collection process, the analytics system may add a checkpoint or marker (e.g., index) after every completed metadata transaction to indicate where it left off accessing the metadata snapshots. The checkpoint may allow the analytics system to return to the checkpoint to resume the process should the process be interrupted for some reason.

File analytics systems and methods including retrieving metadata from file system snapshots

Examples of file analytics systems are described that may obtain metadata data and events data from a virtualized file server. The metadata may be obtained by scanning one or more snapshots of the virtualized file server. The metadata and event data may be used to report various metrics relating to the virtualized file server.

File analytics systems and methods

Examples of file analytics systems are described that may obtain event data from a virtualized file server. The event data may be aggregated and/or filtered to provide metrics which may be adjusted based on the operation of an application used to accomplish a user action. For example, actions relating to an application's temporary file handling may be aggregated and/or excluded when reporting metrics for the virtualized file server. To facilitate reporting of metrics, the file analytics system may provide a lineage index storing an association between files related through operation of the application used to accomplish the user action.

File analytics systems including examples providing metrics adjusted for application operation

Examples of file analytics systems are described that may obtain event data from a virtualized file server. The event data may be aggregated and/or filtered to provide metrics. The file analytics system may obtain event data from the virtualized file server. The file analytics system may process multiple streams of event data in parallel by separating messages corresponding to the event data message topic into multiple partition pipelines. To avoid processing events related to a particular file out of chronological order, the analytics tool may distribute events for the particular file to the same message topic partition pipeline.

File analytics systems and methods including receiving and processing file system event data in order

Examples of a virtualized file server that persistently stores file system event data records are described. The virtualized file server may include an audit framework with a connector publisher that is configured to publish the event data records and other information for consumption by other services using a message system. The event data records may include data related to various operations on the file system executed by the VFS. The VFS may persistently store event data records according to a data retention policy and/or until an event data record is consumed by one or more particular services.

Virtualized file servers and methods to persistently store file system event data

Examples of file analytics systems are described that may obtain metadata data and events data from a virtualized file server. The file analytics systems may detect one or more events from the events data matching a criteria indicating malicious activity. The file analytics systems may validate the detection of malicious activity. The validation may be performed by comparing the file type, such as the MIME type, of sample files before and after the suspected malicious activity. The systems may recover a share of the distributed file server including the one or more affected files by replacing the one or more affected files with stored versions of the one or more affected files from a snapshot of the share taken prior to the detected malicious activity.

Growing community of inventors

Fremont, CA, United States of America

Pankaj Kumar Sinha