6 Configuring the RMAN Environment: Advanced Topics

Configuring Specific Channels: Examples

In this example, you want to send disk backups to two different disks. Configure disk channels as follows:

CONFIGURE DEFAULT DEVICE TYPE TO disk;        # backup goes to disk
CONFIGURE DEVICE TYPE disk PARALLELISM 2;     # two channels used in parallel
CONFIGURE CHANNEL 1 DEVICE TYPE DISK FORMAT '/disk1/%U' # 1st channel to disk1 
CONFIGURE CHANNEL 2 DEVICE TYPE DISK FORMAT '/disk2/%U' # 2nd channel to disk2
BACKUP DATABASE; # backup - first channel goes to disk1 and second to disk2

Assume a different case in which you have two tape drives and want each drive to use tapes from a different tape media family. Configure your default output device and default tape channels as shown in Example 6-1 to use parallel database backups.

CONFIGURE DEFAULT DEVICE TYPE TO sbt;    # backup goes to sbt
CONFIGURE DEVICE TYPE sbt PARALLELISM 2; # two sbt channels allocated by default
# Configure channel 1 to pool named first_pool
CONFIGURE CHANNEL 1 DEVICE TYPE sbt 
  PARMS 'ENV=(OB_MEDIA_FAMILY=first_pool)'; 
# configure channel 2 to pool named second_pool
CONFIGURE CHANNEL 2 DEVICE TYPE sbt 
  PARMS 'ENV=(OB_MEDIA_FAMILY=second_pool)'; 
BACKUP DATABASE; # first stream goes to 'first_pool' and second to 'second_pool'

In Example 6-1, the backup data is divided between the two tape devices. Each configured channel backs up approximately half the total data.

Relationship Between CONFIGURE CHANNEL and Parallelism Setting

The PARALLELISM setting is not constrained by the number of specifically configured channels. For example, if you back up to 20 different tape devices, then you can configure 20 different SBT channels, each with a manually assigned number (from 1 to 20) and each with a different set of channel options. In such a situation, you can set PARALLELISM to any value up to the number of devices, in this instance 20.

RMAN always numbers parallel channels starting with 1 and ending with the PARALLELISM setting. For example, if the default device is SBT and parallelism is set to 3, then RMAN names the channels as follows:

ORA_SBT_TAPE_1
ORA_SBT_TAPE_2
ORA_SBT_TAPE_3

RMAN always uses the name ORA_SBT_TAPE_n even if you configure DEVICE TYPE sbt (not the synonymous sbt_tape). RMAN always allocates the number of channels specified in PARALLELISM, using specifically configured channels if you have configured them and generic channels if you have not. If you configure specific channels with numbers higher than the parallelism setting, then this setting prevents RMAN from using them.

Precompression Block Processing

Better backup compression ratios are achieved by consolidating the free space in each data block, and setting that free space to binary zeroes. This precompression processing stage has the most benefit for data blocks that have been the subject of many deletes and inserts operations. Conversely, it has no effect on data blocks that are still in their initial loaded state.

The OPTIMIZE FOR LOAD option controls precompression processing. By specifying the default, OPTIMIZE FOR LOAD TRUE, you ensure that RMAN optimizes CPU usage and avoids precompression block processing. By specifying OPTIMIZE FOR LOAD FALSE, RMAN uses additional CPU resources to perform precompression block processing.

Basic Compression Option

You can configure the basic compression algorithm, which does not require the Advanced Compression Option, with the following syntax:

CONFIGURE COMPRESSION ALGORITHM 'BASIC';

Advanced Compression Option

If you have enabled the Oracle Database 11g Release 2 Advanced Compression Option, you can choose from the following compression levels:

The compression ratio generally increases from low to high, with a trade-off of potentially consuming more CPU resources.

Because the performance of the various compression levels depends on the nature of the data in the database, network configuration, system resources and the type of computer system and its capabilities, Oracle cannot document universally applicable performance statistics. Which level is best for your environment depends on how balanced your system is regarding bandwidth into the CPU and the actual speed of the CPU. It is highly recommended that you run tests with the different compression levels on the data in your environment. Choosing a compression level based on your environment, network traffic characteristics (workload), and data set is the only way to ensure that the backup set compression level can satisfy your organization's performance requirements and applicable service level agreements.

About Backup Encryption

The V$RMAN_ENCRYPTION_ALGORITHMS view contains a list of encryption algorithms supported by RMAN. If no encryption algorithm is specified, then the default encryption algorithm is 128-bit Advanced Encryption Standard (AES). RMAN encryption requires the COMPATIBLE initialization parameter at a target database to be at least 10.2.0.

RMAN offers the following encryption modes:

• Transparent Encryption of Backups

  This is the default mode and uses the Oracle wallet. A wallet is a password-protected container used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL.

• Password Encryption of Backups

  This mode uses only password protection. You must provide a password when creating and restoring encrypted backups.

• Dual Mode Encryption of Backups

  This mode requires either the wallet or a password.

Encrypted backups are decrypted automatically during restore and recovery, if the required decryption keys are available. Each backup set gets a separate key. The key is stored in encrypted form in the backup piece. The backup is decrypted with keys obtained with a user-supplied password or the Oracle wallet.

To create encrypted backups on disk with RMAN, the database must use the Advanced Security Option. The Oracle Secure Backup SBT is the only supported interface for making encrypted RMAN backups directly to tape. RMAN issues an ORA-19916 error if you attempt to create encrypted RMAN backups using an SBT library other than Oracle Secure Backup. The Advanced Security Option is not required when making encrypted backups using the Oracle Secure Backup SBT.

When you use the BACKUP BACKUPSET command with encrypted backup sets, the backup sets are backed up in encrypted form. Because BACKUP BACKUPSET copies an encrypted backup set to disk or tape, no decryption key is needed during BACKUP BACKUPSET. The data is never decrypted during any part of the operation. The BACKUP BACKUPSET command can neither encrypt nor decrypt backup sets.

Configuring RMAN Backup Encryption Modes

You can use the CONFIGURE command to persistently configure transparent encryption of backups. You can use the command to specify the following:

• Whether to use transparent encryptions for backups of all database files

• Whether to use transparent encryptions for backups of specific tablespaces

• Which algorithm to use for encrypting backups

You can also use the SET ENCRYPTION command to perform the following actions:

• Override the encryption settings specified by the CONFIGURE ENCRYPTION command. For example, you can use SET ENCRYPTION OFF to create an unencrypted backup, even though a database is configured for encrypted backups.

• Set a password for backup encryption, persisting until the RMAN client exits. Because of the sensitive nature of passwords, RMAN does not permit configuration of passwords that persist across RMAN sessions.

Using or not using persistent configuration settings controls whether archived redo log backups are encrypted. Backup sets containing archived redo log files are encrypted if any of the following are true:

• SET ENCRYPTION ON is in effect when the archive log backup is being created.

• Encryption is configured for backups of the whole database or at least one tablespace.

This behavior ensures that the redo associated with any encrypted backup of a data file is also encrypted.

To configure the environment so that all RMAN backups are encrypted:

1. Set up the Oracle wallet as explained in Oracle Database Advanced Security Administrator's Guide.

2. Issue the following RMAN command:

   CONFIGURE ENCRYPTION FOR DATABASE ON;
   

   At this stage, all RMAN backup sets created by this database use transparent encryption by default.

You can explicitly override the persistent encryption configuration for an RMAN session with the following command:

SET ENCRYPTION ON;

The encryption setting remains in effect until you issue the SET ENCRYPTION OFF command during an RMAN session, or change the persistent setting again with the following command:

CONFIGURE ENCRYPTION FOR DATABASE OFF;

Configuring the Backup Encryption Algorithm

You can use the CONFIGURE command to persistently configure the default algorithm to use for encryption when writing backup sets. Possible values are listed in V$RMAN_ENCRYPTION_ALGORITHMS. The default algorithm is AES 128-bit.

To configure the default backup encryption algorithm:

1. Start RMAN and connect to a target database and a recovery catalog (if used).

2. Ensure that the target database is mounted or open.

3. Execute the CONFIGURE ENCRYPTION ALGORITHM command, specifying a valid value from V$RMAN_ENCRYPTION_ALGORITHMS.ALGORITHM_NAME.

   The following example configures the algorithm to AES 256-bit encryption:

   CONFIGURE ENCRYPTION ALGORITHM TO 'AES256';