6 Using Recovery Manager with Oracle Secure Backup

RMAN Environment

This chapter assumes that you are familiar with Recovery Manager. The RMAN environment includes the following basic components:

• RMAN client

  The RMAN client program, which is installed automatically with an Oracle database, initiates database backup and recovery. The RMAN client can back up and recover any Oracle database accessible locally or through Oracle Net so long as it meets compatibility requirements.

• RMAN target database

  The target is the database that RMAN backs up or restores. The RMAN repository, which is the metadata that RMAN uses to manage backup and recovery, is stored in the control file of the target database.

• RMAN recovery catalog

  The recovery catalog is an optional database schema that serves as a secondary repository of RMAN metadata. You can create a centralized recovery catalog in a database to store the metadata for multiple target databases.

Interfaces for Managing Database Backup and Recovery

When performing RMAN backup and restore operations by means of the Oracle Secure Backup SBT interface, you can use the following interfaces:

• RMAN command-line client

  The rman executable is located in the $ORACLE_HOME/bin directory of a database installation. Note the following considerations when using the RMAN command-line client with Oracle Secure Backup:

  • The RMAN client can run from any Oracle home, regardless of whether the computer containing this home is a member of the Oracle Secure Backup administrative domain.

  • The target database host must be a member of the Oracle Secure Backup administrative domain.

  • The target database uses the Oracle Secure Backup SBT interface on the target host to communicate with the Oracle Secure Backup administrative domain.

• Oracle Enterprise Manager 10g Database Control

  You can manage single-instance database operations, including backup and recovery, through the Database Control console. Note the following considerations when using Enterprise Manager Database Control with Oracle Secure Backup:

  • The Database Control console must run on the same host as the target database.

  • The Database Control console must run on the administrative server of the Oracle Secure Backup domain.

• Oracle Enterprise Manager 10g Grid Control

  You can use the Grid Control console to manage multiple databases. Note the following considerations when using Enterprise Manager Grid Control with Oracle Secure Backup:

  • The Grid Control console can run on any database host in the administrative domain. Unlike Database Control, Grid Control does not need to run on the administrative server of the Oracle Secure Backup domain.

  • You can manage SBT backups of all databases in the Oracle Secure Backup administrative domain through Grid Control.

  • You can create a centralized RMAN recovery catalog in the same database that contains the Grid Control repository.

  • When you use version 10.2.0.2 Grid Control, you can use Oracle Secure Backup on a host that runs an Oracle Database 10g Release 1 (10.1) or earlier database, as long as the repository for Enterprise Manager is in an Oracle Database 10g Release 2 database.

RMAN and the Oracle Secure Backup Administrative Domain

How you use RMAN in conjunction with Oracle Secure Backup depends on the configuration of your administrative domain. This section describes two typical scenarios.

Single-Host Administrative Domain

In a single-host administrative domain, one host plays the role of administrative server, media server, and client. An Oracle database is installed on this host. Figure 6-1 illustrates a typical single-host scenario.

Figure 6-1 Single-Host Administrative Domain

Description of "Figure 6-1 Single-Host Administrative Domain"

Because the database is installed on the administrative server, you can use Enterprise Manager Database Control console to perform database backup and restore operations involving Oracle Secure Backup. This chapter is written from the perspective of the administrator of a single-host domain that is configured like the one in Figure 6-1.

Multiple-Host Administrative Domain

In a typical multiple-host administrative domain, the administrative server, media server, and clients are on separate hosts. A single administrative domain can include only one administrative server but may include multiple media servers and clients.

Figure 6-2 illustrates a typical multiple-host domain in which each client host runs an Oracle database. In this example, the administrative server and media server do not run databases. The Windows database includes a centralized recovery catalog to store RMAN metadata for backups of all databases in the domain.

Figure 6-2 Multiple-Host Administrative Domain

Description of "Figure 6-2 Multiple-Host Administrative Domain"

Because the target databases do not reside on the administrative server, you cannot use Enterprise Manager Database Control to back them up through the Oracle Secure Backup SBT interface. You can use Grid Control on one of the clients, however, to initiate SBT operations involving all databases in the administrative domain.

How RMAN Accesses Oracle Secure Backup

Regardless of the domain configuration and the front-end interface that you use to manage backup and recovery, the process by which RMAN communicates with the Oracle Secure Backup SBT library is the same.

Figure 6-3 displays the basic components of RMAN backup and restore operations that use the Oracle Secure Backup SBT interface.

Figure 6-3 RMAN and the Oracle Secure Backup SBT Interface

Description of "Figure 6-3 RMAN and the Oracle Secure Backup SBT Interface"

The basic process for RMAN backup and restore operations with Oracle Secure Backup is as follows:

1. The user starts the RMAN client (either through the command line or the Enterprise Manager console), allocates an SBT channel, and executes a BACKUP or RESTORE command.

   When the channel is allocated, a server session starts on the Oracle database.

2. The server session on the database host makes the backup or restore job request through the Oracle Secure Backup SBT library.

3. Oracle Secure Backup creates the backup or restore job and assigns it a unique identifier such as sbt/15. Refer to Oracle Secure Backup Reference for a description of job identifiers.

4. For backups, Oracle Secure Backup immediately tries to reserve and start the appropriate resources, for example, reserve the tape drive and load a tape. If the resource is unavailable, then Oracle Secure Backup queues the job while it waits for the resource to become available.

   Note:

   You can control how long a job waits in the queue through the rmanresourcewaittime operations policy (set to forever by default), the --waittime option in a backup storage selector, or the RMAN parameter OB_RESOURCE_WAIT_TIME (see "Setting Media Management Parameters in RMAN").

   For RMAN restore operations, the start time depends on the setting of the rmanrestorestartdelay policy in the operations policy class.

   Note:

   SBT backup jobs do not honor the existing Oracle Secure Backup backup windows, but execute immediately whenever they enter the system.

5. Oracle Secure Backup creates or restores the backup pieces.

6. For backups, Oracle Secure Backup stores metadata about RMAN backup pieces in the Oracle Secure Backup catalog.

   The Oracle Secure Backup catalog is stored and managed completely separately from the RMAN recovery catalog. Oracle Secure Backup stores and reports metadata about the contents of each backup piece.

Configuring RMAN Access to the Oracle Secure Backup SBT Library

If you use Enterprise Manager Database Control, then configure RMAN access to Oracle Secure Backup. This preliminary task is described in "Registering an Administrative Server in Enterprise Manager". You need only specify the Oracle Secure Backup home directory. RMAN locates the SBT library automatically.

By default, RMAN looks in a platform-specific default location for the SBT library. On UNIX/Linux, the default library filename is /lib/libobk.so, with the extension name varying according to platform: .so, .sl, .a, and so on. On Windows the default library location is %WINDIR%\System32\orasbt.dll.

When you install Oracle Secure Backup on Linux and UNIX, the installer automatically performs the following tasks:

• Copies the SBT library to the lib subdirectory of the Oracle Secure Backup home

• Creates a symbolic link to the library in the /lib or /usr/lib directory

By default, RMAN searches the standard path and loads the Oracle Secure Backup SBT library when an SBT channel is allocated.

Creating a Preauthorized Oracle Secure Backup Account

RMAN backup and restore operations that make use of Oracle Secure Backup involve interaction between the following users:

• The Oracle Secure Backup user who processes the backup or restore request

  Note that this user must have the following rights:

  • access Oracle backups (set to owner, class, or all)

  • perform Oracle backups and restores

• The operating system user under which the database server session is running

  Typically, the server session runs under the oracle operating system account. Oracle Secure Backup honors SBT requests only if the requesting operating system user accesses Oracle Secure Backup as a user with the correct rights.

As explained in "Assigning Preauthorized Access", you can preauthorize an operating system user to access an Oracle Secure Backup account as a specified user. In the case of RMAN SBT backups, Oracle Secure Backup preauthorizes an operating system user to perform backup and restore operations as an Oracle Secure Backup user with the appropriate rights.

How Oracle Secure Backup Preauthorizes SBT Backups

Figure 6-4 illustrates the basic process in which a preauthorized operating system user submits a backup or restore request to Oracle Secure Backup.

Figure 6-4 Preauthorization for Database Backup and Restore Operations

Description of "Figure 6-4 Preauthorization for Database Backup and Restore Operations"

The preauthorization of the operating system user works as follows:

1. When you start RMAN and allocate an SBT channel, Oracle Database starts a server session.

2. The server session uses the SBT library to communicate with the obproxyd daemon running locally on its host.

3. The local obproxyd daemon determines which operating system user the server session runs under. Assume in this example that the operating system user is named oracle and runs on Linux host brhost2.

4. The local obproxyd daemon checks the operating system user information with the administrative server observiced daemon. If the operating system user on this host and operating system is preauthenticated as an Oracle Secure Backup user, then the login to Oracle Secure Backup is successful.

   For example, assume that the oracle operating system user on host brhost2 is preauthorized to run as Oracle Secure Backup user obuser. Assume also that obuser is a member of the oracle class, which is assigned the perform Oracle backups and restores right by default.

5. The server session uses the Oracle Secure Backup user to back up or restore files.

   The Oracle Secure Backup operations submitted through the SBT interface use the operating system user defined by the Oracle Secure Backup user to access the host. In the example shown in Figure 6-4, the backup and restore operations run under the oracle operating system account on brhost2.

Configuring an RMAN Preauthorization

This section explains how to configure an RMAN preauthorization. You can preauthorize the operating system user during or after installation. The instructions vary according to platform.

Configuring an RMAN Preauthorization on Linux or UNIX During Installation

To create the Oracle Secure Backup user during installation of the Oracle Secure Backup software on Linux or UNIX, modify the obparameters file when prompted by the installob script. The script prompts you as follows:

Have you already reviewed and customized install/obparameters for your
Oracle Secure Backup installation [yes]?

You can enter no and then modify the obparameters file, which is located in the install subdirectory of the Oracle Secure Backup home. Change the value of the following parameter to yes:

create pre-authorized oracle user: no

In the obparameters file, you can specify the default operating system user and group or accept the defaults. For example, on Linux and UNIX the default user is oracle and default group is dba:

default UNIX user:  oracle
default UNIX group: dba

If you accept the default user and group names, then the installation program automatically creates an Oracle Secure Backup user named oracle. The Linux or UNIX user named oracle in the dba group is granted preauthorized access to this Oracle Secure Backup account.

See Also:

Oracle Secure Backup Installation Guide to learn how to install Oracle Secure Backup on Linux and UNIX

Configuring an RMAN Preauthorization on Windows During Installation

To create the Oracle Secure Backup user on Windows, run the InstallShield wizard as described in Oracle Secure Backup Installation Guide. When you are prompted to choose a role for the host, you can select Create "oracle" user and remove the red X as shown in Figure 6-5.

Figure 6-5 Creating the oracle User During a Windows Installation

Description of "Figure 6-5 Creating the oracle User During a Windows Installation"

The installer automatically creates an Oracle Secure Backup user named oracle and assigns it to the oracle class. Example 6-1 shows sample lsuser output for the oracle user after an installation on Windows.

Example 6-1 Default oracle User

ob> lsuser --long oracle
oracle:
    Password:               (not set)
    User class:             oracle
    Given name:             [none]
    UNIX name:              oracle
    UNIX group:             dba
    Windows domain/acct:    [all] Administrator
    NDMP server user:       no
    Email address:          [none]
    UUID:                   e95891fa-5a80-4500-8865-3706a7db74da
    Preauthorized access:
        Hostname:           [all]
        Username:           [all]
        Windows domain:     [all]
        RMAN enabled:       yes
        Cmdline enabled:    no

By default, all Windows users on all Windows domains are preauthorized to make RMAN backups to the Oracle Secure Backup SBT interface.

The Oracle Secure Backup user named oracle does not have the right to perform backups as a privileged user. To enable oracle to make unprivileged backups, ensure that the Windows domain, user name, and password information is correct. By default the password is not set for the user listed in the Windows domain/acct (see output in Example 6-1). You can run the chuser command in obtool to modify the Windows domain setting for the oracle user, either specifying a new password for the currently specified Windows account or entering completely new information.

Example 6-2 specifies the password for the Administrator user listed in the Windows domain/acct shown in Example 6-1. Because no password is specified in --adddomain, obtool prompts for it.

Example 6-2 Setting the Windows Domain Password for the oracle User

ob> chuser oracle --adddomain *,Administrator
Password: 
Password (again): 
ob>

See Also:

• Oracle Secure Backup Installation Guide to learn how to install Oracle Secure Backup on Windows

• Oracle Secure Backup Reference to learn about the chuser command

Configuring an RMAN Preauthorization Post-Installation

To create the Oracle Secure Backup user after installation, use the Web tool as described in "Assigning Preauthorized Access". If you are using Enterprise Manager, then you can navigate to the Oracle Secure Backup Web tool by clicking File System Backup and Restore in the Maintenance page.

Alternatively, you can run the mkuser command in obtool to create the user. Example 6-3 uses mkuser to create an Oracle Secure Backup user named oracle and assign this user to the oracle class. Example 6-3 uses the --preauth option to grant RMAN SBT access to the Linux/UNIX user oracle on host brhost2.

Example 6-3 Preauthorizing an Operating System User to Make RMAN SBT Backups

mkuser oracle --class oracle --preauth brhost2:oracle+rman

See Also:

Oracle Secure Backup Reference to learn about the mkuser command

Creating Media Families for RMAN Backups

A media family is a named classification of volumes that share common attributes. As explained in "Content-Managed Expiration Policies", the default media family for use by RMAN is named RMAN-DEFAULT. Thus, creating media families for use in RMAN backups is optional.

You may find it useful to create different media families depending on the type of backup set: archived redo logs or datafiles. You can create media families in Enterprise Manager. Alternatively, you can use the Oracle Secure Web tool, as described in "Adding a Media Family", or use the mkmf command in obtool.

When you create a media family, you specify a volume expiration policy that determines when volumes in a media family are expired, that is, eligible to be overwritten and recycled. Volumes in a media family use either a content-managed expiration policy or time-managed expiration policy.

Media families that are content-managed (for example, RMAN-DEFAULT) are for RMAN backups only. You can make also RMAN backups to time-managed volumes, which means that it is possible for these volumes to contain a mixture of file system backups and RMAN backup pieces.

To create a content-managed media family in Enterprise Manager Database Control:

1. Log in to the Enterprise Manager Database Control as a user with database administrator rights.

2. Navigate to the Oracle Secure Backup section of the Maintenance page. Figure 3-6 shows the relevant section of the Maintenance page.

3. Click Oracle Secure Backup Device and Media.

   The Administrative Server: hostname page appears.

4. In Media Families, click the adjacent number.

   The Media Families page appears. The table should include a row for the system-supplied RMAN-DEFAULT media family.

5. Click Add to create a new media family.

6. Configure your media family as follows:

   • In the Media Family Name box, enter the name for the media family. For example, enter datafile_mf for a media family that applies to datafiles.

   • In the Write Window box, enter the amount of time during which a volume set can be appended. For example, enter 7 days.

   • In the Retention Policy section, select Content Manages Reuse.

   • In the Comment box, you can optionally enter a description of the media family. For example, you can indicate that it is intended for backups of datafiles only.

7. Click OK.

   You are returned to the Media Families page. The table should now contain the media family that you just created.

Creating a Database Backup Storage Selector

As explained in "Database Backup Storage Selectors", Oracle Secure Backup uses storage selectors to represent backup attributes that describe an Oracle database. You can use storage selectors to specify which resources should be used by Oracle Secure Backup SBT backups. The selectors act as a layer between RMAN, which accesses the database, and the Oracle Secure Backup software, which manages the backup media.

Setting Media Management Parameters in RMAN

This section assumes that you are familiar with setting Recovery Manager media management parameters. For a general explanation of how to specify media management parameters in RMAN, refer to Oracle Database Backup and Recovery Advanced User's Guide.

You can specify media management parameters in RMAN by the following means:

• Environment variables, which are specified with the ENV parameter of the PARMS option on the CONFIGURE or ALLOCATE CHANNEL commands

• The RMAN SEND command

You can use the following Oracle Secure Backup parameters in RMAN backup and restore jobs:

• OB_MEDIA_FAMILY[_n]

  Use this parameter to define which media can be used for backup jobs.

• OB_DEVICE[_n]

  Use this parameter to define which tape drives can be used for backups.

• OB_RESOURCE_WAIT_TIME

  Use this parameter to specify the duration for which a backup or restore job should wait for the required resources to become available.

In general, the preceding media management parameters override the settings of matching database backup storage selectors. Refer to Oracle Secure Backup Reference for an exhaustive chart that shows the relationship between RMAN media management parameters and database backup storage selectors.

To set media management parameters in an RMAN database backup:

1. Follow Step 1 through Step 6 in the section "Performing Backups with RMAN and Oracle Secure Backup".

2. Click Edit RMAN Script.

   The Schedule Customized Backup: Review: Edit RMAN Script page appears.

3. In the main window, modify the script to use media management parameters. For example, assume the backup script is as follows:

   backup device type sbt database include current controlfile;
   backup device type sbt archivelog all not backed up;
   
   

   To configure the backup to use the my_mf media family, you could modify the script as follows:

   run
   {
     allocate channel c1 device type sbt
       parms 'ENV=(OB_MEDIA_FAMILY=my_mf)';
     backup database include current controlfile;
     backup archivelog all not backed up;
   }
   
   

4. Click Submit Job.

   The Status page appears.

About RMAN and Oracle Secure Backup Metadata

Oracle Database Backup and Recovery Basics explains how to access metadata in the RMAN repository through RMAN commands, dynamic performance (V$) views on the target database, and recovery catalog views. Although this metadata includes information about RMAN backups made to the Oracle Secure Backup SBT interface, the metadata is managed by RMAN.

Oracle Secure Backup maintains its own catalog of backup metadata; this backup catalog is located on the administrative server and is not managed by RMAN. You can use the Oracle Secure Backup Web tool to display catalog metadata about RMAN jobs and backup pieces. Alternatively, you can use the lsjob, catxcr, and lspiece commands in obtool.

Displaying RMAN Job Information in Oracle Secure Backup

RMAN backups made with the Oracle Secure Backup SBT interface are subject to all Oracle Secure Backup job management commands. "Managing Backup and Restore Jobs" explains how to manage file system and database backup and restore jobs.

When you use RMAN to backup or restore a database, the job contains the name of the database. Example 6-4 shows sample output for backup and restore jobs relating to a database named orcl.

ob> lsjob --all
Job ID           Sched time  Contents                       State
---------------- ----------- ------------------------------ ---------------------------------------
oracle/1         none    database orcl (dbid=1091504057) completed successfully at 2005/08/11.11:29
oracle/1.1       none    datafile backup                 completed successfully at 2005/08/11.11:29
oracle/2         none    database orcl (dbid=1091504057) completed successfully at 2005/08/11.11:56
oracle/2.1       none    datafile backup                 completed successfully at 2005/08/11.11:56
oracle/3         none    database orcl (dbid=1091504057) completed successfully at 2005/08/11.11:57
oracle/3.1       none    restore piece '06grqejs_1_1'    completed successfully at 2005/08/11.11:57

ob> catxcr --head 22 sbt/6.1
2005/06/28.13:01:04 ______________________________________________________________________
2005/06/28.13:01:04
2005/06/28.13:01:04         Transcript for job sbt/6.1 running on stadv07
2005/06/28.13:01:04
Volume label:
    Volume tag:         ADE202
    Volume ID:          RMAN-DEFAULT-000002
    Volume sequence:    1
    Volume set owner:   root
    Volume set created: Tue Jun 28 13:01:30 2005
    Media family:       RMAN-DEFAULT
    Volume set expires: never; content manages reuse

Archive label:
    File number:        1
    File section:       1
    Owner:              root
    Client host:        stadv07
    Backup level:       0
    S/w compression:    no
    Archive created:    Tue Jun 28 13:01:30 2005

Displaying Backup Piece Information

Typically, you use RMAN to access metadata about RMAN backup sets. You can also view RMAN backup piece information in Oracle Secure Backup.

As explained in "Backup Sets and Backup Images", an RMAN backup piece is represented in Oracle Secure Backup as a backup image. "Managing Backup Images" explains how to use the Web tool to display information about backup pieces recorded in the Oracle Secure Backup catalog. Alternatively, you can use lspiece command. Example 6-6 shows sample output for lspiece.

ob> lspiece --long
Backup piece OID:       104
    Database:               ob
    Database ID:            1566254457
    Content:                archivelog
    Copy number:            0
    Created:                2005/06/28.13:01
    Host:                   stadv07
    Piece name:             05go3tgd_1_1
Backup piece OID:       105
    Database:               ob
    Database ID:            1566254457
    Content:                archivelog
    Copy number:            0
    Created:                2005/06/28.13:02
    Host:                   stadv07
    Piece name:             06go3ti5_1_1

Adding Information About RMAN Backups to the Oracle Secure Backup Catalog

In some circumstances, a tape may contain information about RMAN backups when this information is not in the Oracle Secure Backup catalog. The situation could occur if a disk fails and you must restore files on the administrative server as described in "Restoring Critical Data on the Administrative Server".

To add metadata about RMAN backups to the Oracle Secure Backup catalog, you must use the obtar command-line utility rather than the Web tool or obtool. "Cataloging the Contents of a Backup Image" explains how to use the -tG options in obtar to recatalog the files.