I’m just now getting a little time to catch up on your blog. I read your review of my article with great interest.

Your points are quite right. However, nothing is perfect. The problem that active/active solves is the failure of a site. If a site fails, and there is no backup, all is lost (the press is full of such stories – check out my Never Again articles in the Availability Digest). Active/active provides two or more geographically-separated sites so that you keep going no matter what. True, there is some data loss if asynchronous replication is used – typically tens to hundreds of milliseconds, but at least you are up-and-running. A solution using just co-located fault-tolerant systems is not disaster tolerant. A site disaster will take down the system. The best you can do is to replicate to a remote site. Assuming that you are using asynchronous replication, you will also lose some data. And recovery could be minutes or hours rather than seconds or subseconds as is being achieved with active/active systems.

By the way, if you use synchronous replication, no data is lost and there is no split-brain mode. You are limited to the disatance between nodes by performance concerns (typically tens of kilometers), but that is better than having all of your eggs in one room.Of course, you’ve got to be pretty clever on how you remove the failed system from the scope of further transactions so that processing can proceed, but there are several solutions to this problem.

Why not add an active/active option to ftServer to make it disaster tolerant and fully faiult tolerant?

- Bill