Why replication is not backup

Intermediate⏱ ~17 minceph

What you'll learn

State precisely what replication protects against
Enumerate what it does not protect against
Explain why the confusion persists
Assess a cluster's actual data protection

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Why this matters in production

“It is replicated three times” is offered as a backup answer more often than any other sentence in storage, and it answers a different question.

What replication protects against

Replication and erasure coding protect against the loss of a device or
a failure domain. That is their entire scope.

Event	Replication handles
A disk fails	yes
A host fails	yes, with host-level failure domain
A rack loses power	yes, with rack-level failure domain
Bit rot on one replica	yes, via scrub and repair
An OSD’s data is unreadable	yes

POOL=rbd-vms
RULE=replicated_rule
ceph osd pool get ${POOL} size
ceph osd pool get ${POOL} min_size
ceph osd crush rule dump ${RULE} | python3 -c '
import sys,json
r = json.load(sys.stdin)
for s in r.get("steps", []):
    if s.get("type"): print("failure domain:", s["type"])'

What it does not protect against

Event	Replication handles
A file deleted	no — the deletion is replicated
A database corrupted by the application	no
Ransomware encrypting the data	no
An operator running `rbd rm`	no
A bad CRUSH change destroying placement	no
The cluster itself being lost	no
A pool deleted	no

The unifying property: replication faithfully reproduces every write,
including the ones you did not want.

# what a deletion looks like from the cluster's perspective
POOL=rbd-vms
IMAGE=vm-disk-01
rbd rm ${POOL}/${IMAGE}
# the image is gone from every replica simultaneously

Why the confusion persists

Three durable copies feels like three chances.
It is one copy of the current state, stored three times.

Reasoning	Where it fails
“Three copies means three chances”	they are copies of the same state
“Erasure coding is like RAID, and we backed up RAID”	the analogy holds; the conclusion is that RAID was not backup either
“Snapshots are on the cluster, so we have history”	history on the same cluster shares the cluster’s fate
“The cluster has never lost data”	true and irrelevant to deletion and corruption

ceph df
# capacity is not a protection statement

Assessing actual protection

For each threat, ask: what recovers from it, and has that been tested?

Threat	Requires
Device or host failure	replication — present
Accidental deletion	a copy outside the deletion’s reach
Corruption	a copy from before the corruption
Ransomware	a copy the attacker cannot reach or alter
Cluster loss	a copy on different infrastructure
Operator error	a copy the operator cannot delete

# the questions a protection review actually asks
echo "1. where does a second copy of this data exist?"
echo "2. can the process that could destroy the primary also reach it?"
echo "3. how old is it?"
echo "4. when was a restore from it last performed?"

Quiz

Knowledge check · 4 questions

Q1. Why does replication not protect against deletion?

Deletions bypass the replication path and are applied only to the primary OSD for the object Replicas are updated asynchronously, so a deletion may reach some copies and not others A deletion is a write, and replication propagates every write to all copies immediately Deletions are handled by the monitors rather than by the OSDs that hold the copies
Q2. A same-cluster snapshot is a real control against the two commonest data-loss threats and no control at all against the two most severe.

True False
Q3. Assess a cluster's actual data protection.

A team states their data is protected because pools are 3× replicated across racks and RBD snapshots are taken nightly.
Q4. What four questions does a data protection review actually ask?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Credit same-cluster snapshots as real protection against deletion and application corruption while naming what they do not cover — cluster loss and an actor able to delete them. Replication propagates every write, including the ones nobody wanted.

Cross-course references

Kubernetes: replicas do not protect against a bad manifest applied to all of them
Linux: RAID was never backup for the identical reason