In our architecture to achieve HA we've created an active/active setup with our DR data center.
We push events upstream from all the remote log collectors (virtual or physical) and just duplicate the logs by pointing to two log decoders (PROD and DR).
I've often requested true HA features like clustered Reporting-Engines, clustered ESA mongodb instances, synchronized H2 instances across NetWitness servers but I have not heard how realistic it is they'll make it into the product.
