Veeam Backup & Replication - Oracle Database backup

Note: The description in the article is based on Veeam Backup & Replication 12.1, licensed using Veeam Universal License (VUL), which is equivalent to Enterprise Plus.

Veeam Plug-in for Oracle RMAN

Veeam Plug-ins for Enterprise Applications Guide

The best way to backup Oracle databases (for most situations) is to use Oracle Recovery Manager (RMAN) with the help of Veeam Plug-in for Oracle RMAN. It enables transactionally consistent backup and recovery of Oracle databases. It works with native Oracle backup and recovery functions.

Standalone Mode vs Managed Mode

Previously, only Standalone Mode was available, where the Plug-in had to be manually installed and configuration was done on the Oracle server side. Backups can be stored in Veeam Repository and recovery can be performed from the Veeam Backup & Replication console (we have Veeam Explorer for Oracle).

A Backup Job is automatically created in Veeam Backup & Replication (the name consists of the server/cluster name and storage) for all backup processes initiated in Oracle RMAN. We cannot modify or control the jobs (only delete or disable them), but we can view statistics about the backup process.

Since Veeam Backup & Replication 12, Managed Mode is available, where we can perform automated installation and management of the Plug-in from the Veeam server. We can also (centrally) create and configure backup policies on protected computers.

We briefly described the original options for Oracle DB backup in Veeam Backup & Replication - Application Backup - Oracle Database.

The official Veeam documentation may not be fully updated yet. The Standalone Mode is primarily covered in the Veeam Plug-in for Oracle RMAN section. And the Managed Mode is covered in the Veeam Plug-in Management section.

Veeam Plug-in and Backup Files

The Veeam Plug-in functions as an agent between Oracle RMAN and the Veeam backup storage. It compresses database backups and transfers them to storage connected to Veeam Backup & Replication. It stores data in a proprietary Veeam format in a dedicated folder for the job.

The backup creates files

• VAB - compressed copy of Oracle database (full backup, incremental and logs)
• VASM - metadata containing information about the backup
• VACM - backup job metadata

Since Veeam Backup & Replication 12.1, it allows reusing backup files and placing multiple backups into a single VAB file. This is to optimize the Veeam configuration database, as many files and a lot of metadata are created, which are stored in the Veeam configuration database.

Requirements and Support

Supported versions of operating systems (Windows and Linux) and Oracle DB are listed in the documentation System Requirements (for Standalone Mode System Requirements). Oracle Express Edition (XE) is not supported. Veeam Plug-in for Oracle RMAN supports backup of Oracle Real Application Clusters (RAC).

Oracle DB must be in OPEN state (running). And it must operate in archive mode (ARCHIVELOG mode), where all transactions are stored in the Redo log and logs are not overwritten but archived. This allows restoring the DB to any point in time. It also allows backing up a running database (online - hot backup) in this mode. Database backup and separate archived Redo logs backup are performed.

For backup and recovery operations, we need certain permissions Permissions and Permissions. Certain ports must be allowed for communication Ports.

Using Oracle RMAN, we only backup the database and logs. It may be appropriate to backup some files from the database server as well, for example using Veeam Agent. Info Additional Files to Back Up.

Deploying Veeam Plug-in from Veeam Server

Computer Discovery and Veeam Plug-in Deployment

For automated Plug-in installation, we can use Protection Group, in which we organize computers with databases that we want to protect. We can use automatic computer discovery and Plug-in installation. It works the same as for installing Veeam agent.

Note: I performed tests in a lab environment. Oracle DB 19c simply installed on a VM with AlmaLinux 9.4. For simplicity, I used common (main) accounts instead of separation and better security.

Creating Protection Group

Creating Protection Groups

• Inventory - Physical Infrastructure - Create Protection Group
• Name - each group must have a unique name

• Type - Individual computers

• Computers - Add - enter the server name or IP address and select (add) login credentials (SSH credentials)

• use the Test Now button to verify connection to the server, if we have the safer option Add unknown hosts to the list manually in Veeam settings, then a fingerprint verification error will probably appear and we will need to set server trust

• Options
  • set when to scan the Protection Group
  • choose the distribution server
  • if we don't need it, don't install the agent
  • select installation of application plug-in and under Configure choose Oracle RMAN
  • we can set automatic update (server restart should not be needed when installing the plug-in)

• Review - displays a list of components for the distribution server, whether they are already installed or will be installed
• Summary - if the server is untrusted, turn off Run discovery when I click Finish

Note: Since Veeam Backup & Replication version 12.1, it is possible to connect Linux using certificate authentication. Deploying Plug-in Using Pre-Installed Veeam Deployer Service

Verifying SSH Fingerprints - Setting Server Trust

Adding Computers to Trusted Hosts List, Validating SSH Fingerprints

If the server was classified as untrusted, we need to set its trust.

• Inventory - Physical Infrastructure / Virtual Infrastructure - Untrusted
• right-click on the server and select Trust

Plug-in Installation - Rescan Protection Group

Rescanning Protection Group

Installation occurs during Protection Group Rescan. We can trigger it manually.

• Inventory - Physical Infrastructure - Create Protection Group
• right-click on our Protection Group and select Rescan

During the process, Veeam components Installer service, Transport service and in our case RMAN Linux Plug-in will be installed and configured.

Application backup policy

Veeam primarily uses the term backup job - Backup Job. But somewhere, for example for a job managed by Veeam agent, the term backup policy - Backup Policy is used. For database backups on computers with Veeam Plug-in, the term Application Backup Policy is used.

Creating Oracle RMAN Backup Policy

Creating Oracle RMAN Backup Policy, Application Backup Policies

• Home - Backup Job - Application - Oracle RMAN

• Name - each job must have a unique name that suggests its purpose/content
• Databases - the basis of the job is to determine which Oracle databases we will back up, we can select Protection Group, computers, Oracle home, Oracle databases (only computers where Oracle DB was detected are offered in the list), we can use Exclusions to omit certain objects

• Storage - we select Repository (backup storage) and Retention Policy (how many recovery points or days we want to keep, pay attention to the CONTROL_FILE_RECORD_KEEP_TIME parameter on the Oracle server)
  • Advanced - Backup - we select the backup mode for incremental backups, Differential backup - data changed since the last incremental data backup, Cumulative backup - data changed since the last full data backup, under Create level 0 backups periodically we plan performing full backups
  • Advanced - Storage - we can enable data compression during backup (runs on the Oracle server) either using Veeam Data Mover (ZSTD algorithm) or Oracle RMAN
  • Advanced - Notifications - setting notifications when the job is completed (we can set globally or customize for individual job, to be able to set on the job, it must be allowed globally, for example if we don't allow Success globally, it won't work when set on the job)
  • Advanced - Oracle - we enter the number of data channels that Veeam Plug-in uses for parallel database backup

• Database Processing - we set up processing of objects that we added in the Databases step (we can add contained lower-level objects here)
  • we enter login credentials (Credentials) for DB backup
  • we can enable deletion of archived redo logs (quite important for DBs in ARCHIVELOG mode), at the same time we set how often log backup should occur (1 to 480 minutes) and how many parallel channels will be used

• Schedule - we can schedule regular task execution (the second option is to run manually)

Account for Oracle DB Backup

The account (Credentials) for database backup, which we set in the Database Processing step, is important. The dialog itself states that it must be an operating system user with SYSDBA privileges. More information in Permissions.

I have no experience with Oracle DB, so I tried to use the root and sys accounts, but only the oracle account worked. When using an incorrect account, Veeam ended with some error:

Failed to execute plug-in manager command: Oracle error has occurred. ORA-01017: invalid username/password; logon denied  

Failed to perform backup task Error: TCP stream was closed Failed to start 'RMANPluginManager' executable. Failed to create
'/opt/veeam/VeeamPluginforOracleRMAN/RMANPluginManager' agent. Failed to invoke rpc command

I encountered another error because my test DB was not in archive mode.

RMAN error: RMAN-03002: failure of backup plus archivelog command at 07/10/2024 15:55:16 RMAN-06149: cannot BACKUP DATABASE
 in NOARCHIVELOG mode

Oracle RMAN Backup Policy Behavior

We can find the created task under Jobs - Application Plug-ins. Its name is what we entered. The type is Oracle RMAN Backup, same as for tasks in Standalone Mode, but there's a different icon here. The backup policy runs continuously and switches to Idle state. The database log backup is a separate task that runs concurrently with the database backup.

Backups are under Backups - Disk - Oracle RMAN - task name - server FQDN. A folder is created on the storage for each Veeam plug-in and inside a folder for each Backup Policy. The files are the same for both Managed Mode and Standalone Mode.

When backup is in progress, three different types of sessions run: Application Backup Policy, Oracle RMAN Backup, Application Log Backup.

Veeam Agent Backup Job

Creating Veeam Agent Backup Jobs

If we want to back up some files from the database server, like Oracle Home, we need to create a separate task. On a physical server, we can use Veeam Agent. We wrote about this backup in the article Veeam Agent Backup Job.

To install the agent, we can modify the Protection Group settings or manually start the installation on a specific server from the group. Installing Veeam Agent may require a server restart.

• Home - Backup Job - Linux computer
• Job Mode - Type: Server, Mode: Managed by backup server
• Name - each task must have a unique name that suggests its purpose/content
• Computers - we add either the entire Protection Group or selected computers
• Backup Mode - for our case, where we want to back up selected folders, we choose File level backup
• Objects - we enter paths to folders

• Storage - we set the required backup properties and backup retention (Repository, Retention, Full Backup, Maintenance, Notifications)
• Guest Processing - we probably don't need to use
• Schedule - we can schedule regular task execution (the second option is to run manually)