> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/disaster-recovery-and-live-backup-overview.md). # Disaster Recovery and Live Backup Overview Live Backup enables you to mirror your production server to a backup server. In a disaster recovery situation, you can easily convert your backup server to be the production server. {% hint style="info" %} ### Note This chapter contains instructions for configuring Live Backup for a single server deployment. For multi-tenant deployments, follow the [Configure Live Backup](/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-live-backup.md) instructions in the multi-tenant guide. {% endhint %} Server actions are mirrored in real-time. There might be pending actions due to high server load, connectivity issues, and so on. Consider the following: * Live Backup uses a single main server and a single standby server. Beyond these, additional servers are not currently supported. * Active/Active configuration is not currently supported. * Each host retains its own distinct IP address and hostname. * Neither host has any awareness of which node is truly active. Therefore, failover is not dynamic, meaning that making a node active must be done manually, by an administrator. In the event of a server failover, engines dynamically reconnect to the active host. Although Live Backup works in real time, in rare cases, due to communication issues/downtime/heavy load on the server or a server crash/restart, the number of pending actions to mirror is too great. At that point the Live Backup works in "recovery mode" to avoid data loss and to avoid using too much resources. Once it's done recovering it returns to live backup mode. Cortex XSOAR persists each and every mirror action until it's verified on the other side, so when restarting the service, we ensure nothing is missed. When Live Backup enters recovery mode, an error message appears in the UI. This message is just an indication that the system is in recovery mode. When using Cortex XSOAR with Elasticsearch, Live Backup is not available. To back up or restore the contents of your Elasticsearch database, see [Disaster Recovery for Elasticsearch](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md). You can also implement a full [high availability solution](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/high-availability-overview.md). {% hint style="warning" %} ### Caution As the process of making a Cortex XSOAR server active is a manual process, it is conceivable that two servers could be active simultaneously. You must avoid this scenario because both hosts collect and work on potentially the same security incidents, which could lead to the following: * Incident duplication * A higher load on your integration endpoints * Possible significant database inconsistencies due to duplication of internal identifiers being shared between nodes and causing existing incidents to be overwritten. {% endhint %} {% hint style="info" %} ### Tip If there is ever uncertainty about whether a host that is presently down or stopped was in an active state before it went offline, it is recommended that you put the presently active host into a standby state before starting the Cortex XSOAR service on the other host. You can then make it active again after you have confirmed whether the host you are starting is already in active mode. {% endhint %} To configure the live backup environment, see [Configure the Live Backup Environment](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment.md). The following scenarios describe how to test, and deal with active server failures: * [DR Scenario: Testing the DR Environment](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-testing-the-dr-environment.md) * [DR Scenario: Unrecoverable Active Server Failure](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-active-server-failure.md) * [DR Scenario: Unrecoverable Standby Server Failure](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-standby-server-failure.md) When you first install the Cortex XSOAR server and it starts for the first time, you can use a configuration file to transition between DR states, as described in [Transition Between DR States Through the Configuration File](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-between-dr-states-through-the-configuration-file.md). If you need to upgrade your live backup environment, see [Upgrade the Live Backup Environment](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/upgrade-the-live-backup-environment.md). For details about the relationship between engines and disaster recovery, see [Engines and Disaster Recovery Troubleshooting](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/engines-and-disaster-recovery-troubleshooting.md). For information about host names, DNS, and disaster recovery, see [Host Names, DNS, and Disaster Recovery](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/host-names-dns-and-disaster-recovery.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/disaster-recovery-and-live-backup-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.