6 Configuring the RMAN Environment: Advanced Topics

Configuring Specific Channels: Examples

In this example, you want to send disk backups to two different disks. Configure disk channels as follows:

CONFIGURE DEFAULT DEVICE TYPE TO disk;        # backup goes to disk
CONFIGURE DEVICE TYPE disk PARALLELISM 2;     # two channels used in in parallel
CONFIGURE CHANNEL 1 DEVICE TYPE DISK FORMAT '/disk1/%U' # 1st channel to disk1 
CONFIGURE CHANNEL 2 DEVICE TYPE DISK FORMAT '/disk2/%U' # 2nd channel to disk2
BACKUP DATABASE; # backup - first channel goes to disk1 and second to disk2

Assume a different case in which you have two tape drives and want each tape drive to use tapes from a different tape media family. Configure your default output device and default tape channels as shown in the following example to parallelize the database backup.

CONFIGURE DEFAULT DEVICE TYPE TO sbt;    # backup goes to sbt
CONFIGURE DEVICE TYPE sbt PARALLELISM 2; # two sbt channels allocated by default
# Configure channel 1 to pool named first_pool
CONFIGURE CHANNEL 1 DEVICE TYPE sbt 
  PARMS 'ENV=(OB_MEDIA_FAMILY=first_pool)'; 
# configure channel 2 to pool named second_pool
CONFIGURE CHANNEL 2 DEVICE TYPE sbt 
  PARMS 'ENV=(OB_MEDIA_FAMILY=second_pool)'; 
BACKUP DATABASE; # first stream goes to 'first_pool' and second to 'second_pool'

In Example 6-1, the backup data is divided between the two tape devices. Each configured channel backs up roughly half the total data.

Relationship Between CONFIGURE CHANNEL and Parallelism Setting

The PARALLELISM setting is not constrained by the number of specifically configured channels. For example, if you back up to 20 different tape devices, then you can configure 20 different SBT channels, each with a manually assigned number (from 1 to 20) and each with a different set of channel options. In such a situation, you can set PARALLELISM to any value up to the number of devices, in this instance 20.

RMAN always numbers parallel channels starting with 1 and ending with the PARALLELISM setting. For example, if the default device is SBT and parallelism is set to 3, then RMAN names the channels as follows:

ORA_SBT_TAPE_1
ORA_SBT_TAPE_2
ORA_SBT_TAPE_3

RMAN always uses the name ORA_SBT_TAPE_n even if you configure DEVICE TYPE sbt (not the synonymous sbt_tape). RMAN always allocates the number of channels specified in PARALLELISM, using specifically configured channels if you have configured them and generic channels if you have not. If you configure specific channels with numbers higher than the parallelism setting, then this setting prevents RMAN from using them.

Pre-Compression Block Processing

Oracle can achieve better backup compression ratios by consolidating the free space in each data block, and setting that free space to binary zeroes. This pre-compression processing stage has the most benefit for data blocks that have been the subject of many deletes and inserts. Conversely, it has no effect on data blocks that are still in their initial loaded state.

The OPTIMIZE FOR LOAD option controls pre-compression processing. By specifying the default, OPTIMIZE FOR LOAD TRUE, Oracle optimizes CPU usage and avoids pre-compression block processing. By specifying OPTIMIZE FOR LOAD FALSE, Oracle uses additional CPU resources to perform pre-compression block processing.

Basic Compression Option

You can configure the basic compression algorithm, which does not require the Advanced Compression Option, with the following syntax:

CONFIGURE COMPRESSION ALGORITHM 'BASIC';

Advanced Compression Option

If you have enabled the Oracle Database 11g Release 2 Advanced Compression Option, you can choose from the following compression levels:

Note: The compression ratio generally increases from LOW to HIGH, with a trade-off of potentially consuming more CPU resources.

Since the performance of the various compression levels depends on the nature of the data in the database, network configuration, system resources and the type of computer system and its capabilities, Oracle cannot document universally applicable performance statistics. The decision as to which level is best must factor in on how balanced your system is regarding bandwidth into the CPU as well as the actual speed of the CPU. It is highly recommended that you run tests with the different compression levels on the data in your environment. Choosing a compression level based on your environment, network traffic characteristics (workload) and dataset is the only way to ensure that the backup set compression level can satisfy your organization's performance requirements and any applicable service level agreements.

Note: Restoring a compressed backup is performed in-line, and does not require decompression.

About Backup Encryption

The V$RMAN_ENCRYPTION_ALGORITHMS view contains a list of encryption algorithms supported by RMAN. If no encryption algorithm is specified, then the default encryption algorithm is 128-bit Advanced Encryption Standard (AES). RMAN encryption requires the COMPATIBLE initialization parameter at a target database to be at least 10.2.0.

RMAN offers the following encryptions modes:

• Transparent Encryption of Backups

  This is the default mode and uses the Oracle wallet. A wallet is a password-protected container used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL.

• Password Encryption of Backups

  This mode uses only password protection. You must provide a password when creating and restoring encrypted backups.

• Dual Mode Encryption of Backups

  This mode requires either the wallet or a password.

Encrypted backups are decrypted automatically during restore and recovery, as long as the required decryption keys are available. Each backup set gets a separate key. The key is stored in encrypted form in the backup piece. The backup is decrypted with keys obtained by means of a user-supplied password or the Oracle wallet.

To create encrypted backups on disk with RMAN, the database must use the Advanced Security Option. The Oracle Secure Backup SBT is the only supported interface for making encrypted RMAN backups directly to tape. RMAN issues an ORA-19916 error if you attempt to create encrypted RMAN backups using an SBT library other than Oracle Secure Backup. The Advanced Security Option is not required when making encrypted backups using the Oracle Secure Backup SBT.

When you use the BACKUP BACKUPSET command with encrypted backup sets, the backup sets are backed up in encrypted form. Because BACKUP BACKUPSET copies an already-encrypted backup set to disk or tape, no decryption key is needed during BACKUP BACKUPSET. The data is never decrypted during any part of the operation. The BACKUP BACKUPSET command can neither encrypt nor decrypt backup sets.

Configuring RMAN Backup Encryption Modes

You can use the CONFIGURE command to persistently configure transparent encryption of backups. You can use the command to specify the following:

• Whether to use transparent encryptions for backups of all database files

• Whether to use transparent encryptions for backups of specific tablespaces

• Which algorithm to use for encrypting backups

You can also use the SET ENCRYPTION command to perform the following actions:

• Override the encryption settings specified by the CONFIGURE ENCRYPTION command. For example, you can use SET ENCRYPTION OFF to create an unencrypted backup, even though a database is configured for encrypted backups.

• Set a password for backup encryption, persisting until the RMAN client exits. Because of the sensitive nature of passwords, RMAN does not permit configuration of passwords that persist across RMAN sessions.

Using or not using persistent configuration settings control whether archived redo log backups are encrypted. Backup sets containing archived redo log files are encrypted if any of the following are true:

• SET ENCRYPTION ON is in effect at the time that the archive log backup is being created.

• Encryption is configured for backups of the whole database or at least one tablespace.

This behavior ensures that the redo associated with any encrypted backup of a datafile is also encrypted.

To configure the environment so that all RMAN backups are encrypted:

1. Set up the Oracle wallet as explained in Oracle Database Advanced Security Administrator's Guide.

2. Issue the following RMAN command:

   CONFIGURE ENCRYPTION FOR DATABASE ON;
   

   At this stage, all RMAN backup sets created by this database use transparent encryption by default.

You can explicitly override the persistent encryption configuration for an RMAN session with the following command:

SET ENCRYPTION ON;

The encryption setting remains in effect until you issue the SET ENCRYPTION OFF command during an RMAN session, or change the persistent setting again with the following command:

CONFIGURE ENCRYPTION FOR DATABASE OFF;

Configuring the Backup Encryption Algorithm

You can use the CONFIGURE command to persistently configure the default algorithm to use for encryption when writing backup sets. Possible values are listed in V$RMAN_ENCRYPTION_ALGORITHMS. The default algorithm is AES 128-bit.

To configure the default backup encryption algorithm:

1. Start RMAN and connect to a target database and a recovery catalog (if used).

2. Ensure that the target database is mounted or open.

3. Execute the CONFIGURE ENCRYPTION ALGORITHM command, specifying a valid value from V$RMAN_ENCRYPTION_ALGORITHMS.ALGORITHM_NAME.

   The following example configures the algorithm to AES 256-bit encryption:

   CONFIGURE ENCRYPTION ALGORITHM TO 'AES256';