Glossary

Active-active disaster recovery

Active-active disaster recovery runs production at two or more sites at the same time, each one serving real users from current data. Losing one site reduces capacity instead of triggering a failover, because the surviving sites are already carrying traffic.

How does active-active disaster recovery work?

A global load balancer splits traffic across the sites. Data is replicated between them in one of two ways. With synchronous replication, a write is confirmed only after both sites have it, so nothing acknowledged is ever lost. With asynchronous replication, the write is confirmed locally and copied a moment later, so the second site trails by seconds or minutes. When a site drops out, the load balancer stops sending it traffic and the others absorb the load. There is no standby to wake up, which is the main difference from a conventional failover design.

The standby problem is the reason teams adopt it. A passive site that has never served real traffic is an assumption, and the day of the outage is the first time the assumption is tested. In active-active, every site proves itself continuously.

Why does every site need to carry the full load alone?

Active-active is often sold as using all the hardware that was paid for. That is only true until a site fails. If two sites each run at 70 percent of their capacity, the loss of one pushes the survivor to 140 percent, and the service degrades or stops. So each site is sized to carry the whole workload by itself, which means roughly double the capacity for two sites.

Adding sites changes the arithmetic. With three sites, any two have to be able to cover the full load, so each needs about half of it, and total capacity is about one and a half times the workload instead of twice. The cost of active-active falls as the site count rises, which is why larger deployments often use three or more.

Where does synchronous replication stop working?

Light in fiber covers about 100 kilometers per millisecond of round trip, and every synchronous write waits for at least one round trip to the other site. Within a metro area that wait is a millisecond or two and applications tolerate it. Across continents it is tens of milliseconds on every write, which most databases and applications cannot absorb. Synchronous replication therefore stays within metro distances. Sites further apart replicate asynchronously and accept a recovery point measured in seconds, as described under the recovery point objective.

Two active sites also need a tiebreaker. If the link between them drops, each side may conclude the other is dead and keep accepting writes, producing conflicting data. A small witness at a third location casts the deciding vote, so only one side keeps writing.

What does active-active not protect against?

It protects against losing a site. It does not protect against losing the data. Replication carries a mistaken bulk delete, a corrupted database or ransomware-encrypted files to every site within seconds, because the system cannot tell damage from legitimate change. An active-active pair with no other copy has two sites holding the same ruined data.

The remaining gap is closed by a copy outside the replication path, such as an immutable backup held under separate credentials, from which an earlier clean version can be restored. Active-active covers availability. Backup covers history.

Frequently asked questions

Is active-active the same as high availability?

They overlap but are not identical. High availability keeps a service running through component failures, usually inside one site. Active-active applies the same idea to whole sites.

Does active-active remove the need for a recovery plan?

No. A site loss still needs capacity checks, traffic rules and a plan for rebuilding the lost site. What disappears is the cutover step and its downtime.

How is active-active different from active-passive?

In active-passive, one site serves traffic and the other waits and takes over after a switch. In active-active, all sites serve traffic, so there is no switch to fail. The cost is higher capacity and harder data consistency.