8 RMAN Backup Concepts

You can use the BACKUP command to make consistent and inconsistent backups of the database. A consistent backup occurs when the database is in a consistent state. A database is in a consistent state after being shut down with the SHUTDOWN NORMAL, SHUTDOWN IMMEDIATE, or SHUTDOWN TRANSACTIONAL commands. A consistent shutdown guarantees that all redo has been applied to the data files. If you mount the database and make a backup at this point, then you can restore the database backup later and open it without performing media recovery. But you will, of course, lose all transactions that occurred after the backup was created.

Any database backup that is not consistent is an inconsistent backup. A backup made when the database is open is inconsistent, as is a backup made after an instance failure or SHUTDOWN ABORT command. When a database is restored from an inconsistent backup, Oracle Database must perform media recovery before the database can be opened, applying changes from the redo logs that took place after the backup was created.

If the database runs in ARCHIVELOG mode, and you back up the archived redo logs and data files, inconsistent backups can be the foundation for a sound backup and recovery strategy. Inconsistent backups offer superior availability because you do not have to shut down the database to make backups that fully protect the database.

RMAN can store backup data in a logical structure called a backup set, which is the smallest unit of an RMAN backup. A backup set contains the data from one or more data files, archived redo logs, control files, or server parameter file. Backup sets, which are only created and accessed through RMAN, are the only form in which RMAN can write backups to media managers such as tape drives and tape libraries.

A backup set contains one or more binary files in an RMAN-specific format. Each of these files is known as a backup piece. A backup set can contain multiple data files. For example, you can back up 10 data files into a single backup set consisting of a single backup piece. In this case, RMAN creates one backup piece as output. The backup set contains only this backup piece.

If you specify the SECTION SIZE parameter on the BACKUP command, then RMAN produces a multisection backup. This is a backup of a single large file, produced by multiple channels in parallel, each of which produces one backup piece. Each backup piece contains one file section of the file being backed up.

For non-multisection backups, RMAN only records backup sets in the repository that complete successfully. There is no such thing as a partial backup set. This differs from an unsuccessful multisection backup, where it is possible for RMAN metadata to contain a record for a partial backup set. In the latter case, you must use the DELETE command to delete the partial backup set.

RMAN uses two types of block compression when creating backup sets:

• Unused Block Compression (Supports disk backup and Oracle Secure Backup tape backup)

• Null Block Compression (Supports all backups)

RMAN block compression is not traditional binary compression. Rather, it is a set of techniques that RMAN uses to altogether avoid backing up certain blocks that are not needed in this backup.

RMAN supports binary compression of backup sets. Binary compression is only enabled when you specify AS COMPRESSED BACKUPSET in the BACKUP command, or one-time with the CONFIGURE DEVICE TYPE <DISK | SBT> BACKUP TYPE TO COMPRESSED BACKUPSET command.You have two binary compression options:

• You can use the BASIC compression algorithm, which does not require the Oracle Advanced Compression option. This setting offers a compression ratio comparable to MEDIUM, at the expense of additional CPU consumption.

• If you have enabled the Oracle Advanced Compression option, you can choose from the compression levels outlined in "About Oracle Advanced Compression Option".

In backup undo optimization, RMAN excludes undo not needed for recovery of a backup, that is, for transactions that have been committed. Backup undo optimization works for disk backups and Oracle Secure Backup (OSB) tape backups. Unlike backup optimization, backup undo optimization is not configurable.

RMAN supports backup encryption for backup sets. You can use keystore-based transparent encryption, password-based encryption, or both. You can use the CONFIGURE ENCRYPTION command to configure persistent transparent encryption. Use the SET ENCRYPTION command at the RMAN session level to specify password-based encryption.

To create encrypted backups on disk with RMAN, the database must use the Advanced Security Option. For encrypted RMAN backups directly to tape, the Oracle Secure Backup SBT is the only supported interface.

You can either let RMAN determine a unique name for backup pieces or use the FORMAT clause to specify a name. If you do not specify the FORMAT parameter, then RMAN automatically generates a unique file name with the %U substitution variable in the default backup location.

An example of RMAN generating an SBT backup piece name by %U is:

2i1nk47_1_1

An example of a non- Oracle Managed File (OMF) backup piece on disk is:

/backups/TEST/2i1nk47_1_1

The FORMAT clause supports substitution variables other than %U for generating unique file names. For example, you can use %d to generate the name of the database, %I for the DBID, %t for the time stamp, and so on.

You can specify up to four FORMAT parameters. If you specify multiple FORMAT parameters, then RMAN uses the multiple FORMAT parameters only when you specify multiple copies. You can create multiple copies by using the BACKUP ... COPIES, SET BACKUP COPIES, or CONFIGURE ... BACKUP COPIES commands.

By default a backup set contains one backup piece. To restrict the size of each backup piece, specify the MAXPIECESIZE option of the CONFIGURE CHANNEL or ALLOCATE CHANNEL commands. This option limits backup piece size to the specified number of bytes. If the total size of the backup set is greater than the specified backup piece size, then RMAN creates multiple physical pieces to hold the backup set contents.

You can use this option for media managers that cannot manage a backup piece that spans multiple tapes. For example, if a tape can hold 10 GB, but the backup set being created must hold 80 GB of data, then you must instruct RMAN to create backup pieces of 10 GB, small enough to fit on the tapes used with the media manager. In this case, the backup set media consists of eight tapes. Media managers supporting SBT 2.0 can return a value to RMAN indicating the largest supported backup piece size, which RMAN uses in planning backup activities.

If you specify the SECTION SIZE parameter on the BACKUP command, then RMAN can create a multisection backup. In this case, a single backup set can contain multiple backup pieces, each containing a file section. The purpose of multisection backups is to enable multiple channels to back up a large file in parallel.

You use the backupSpec clause of the BACKUP command to specify the objects to be backed up. Each backupSpec clause produces at least one backup set.

The total number and size of backup sets depends mostly on an internal RMAN algorithm. However, you can influence RMAN behavior with the MAXSETSIZE parameter in the CONFIGURE or BACKUP command. By limiting the size of the backup set, the parameter indirectly limits the number of files in the set and can possibly force RMAN to create additional backup sets. Also, you can specify BACKUP ... FILESPERSET to specify the maximum number of files in each backup set.

When creating backup sets, RMAN can simultaneously read multiple files from disk and then write their blocks into the same backup set. For example, RMAN can read from two data files simultaneously, and then combine the blocks from these data files into a single backup piece. The combination of blocks from multiple files is called backup multiplexing. Image copies, by contrast, are never multiplexed.

As Figure 8-1 illustrates, RMAN can back up three data files into a backup set that contains only one backup piece. This backup piece contains the intermingled data blocks of the three input data files.

Figure 8-1 Data File Multiplexing

Description of "Figure 8-1 Data File Multiplexing"

RMAN multiplexing is determined by several factors. For example, the FILESPERSET parameter of the BACKUP command determines how many data files to put in each backup set. The MAXOPENFILES parameter of ALLOCATE CHANNEL or CONFIGURE CHANNEL defines how many data files RMAN can read from simultaneously. The basic multiplexing algorithm is as follows:

• Number of files in each backup set

  This number is the minimum of the FILESPERSET setting and the number of files read by each channel. The FILESPERSET default is 64.

• The level of multiplexing

  This is the number of input files simultaneously read and then written into the same backup piece. The level of multiplexing is the minimum of MAXOPENFILES and the number of files in each backup set. The MAXOPENFILES default is 8.

Suppose that you back up 12 data files with one channel when FILEPERSET is set to 4. The level of multiplexing is the lesser of this number and 8. Thus, the channel simultaneously writes blocks from 4 data files into each backup piece.

Now suppose that you back up 50 data files with one channel. The number of files in each backup set is 50. The level of multiplexing is the lesser of this number and 8. Thus, the channel simultaneously writes blocks from 8 data files into each backup piece.

RMAN multiplexing of backup sets is different from media manager multiplexing. One type of media manager multiplexing occurs when the media manager writes the concurrent output from multiple RMAN channels to a single sequential device. Another type occurs when a backup mixes database files and non-database files on the same tape.

During a proxy copy, RMAN turns over control of the data transfer to a media manager that supports this feature. Proxy copy can only be used with media managers that support it and cannot be used with channels of type DISK. The PROXY option of the BACKUP command specifies that a backup is a proxy copy.

For each file that you attempt to back up with the BACKUP PROXY command, RMAN queries the media manager to determine whether it can perform a proxy copy. If the media manager cannot proxy copy the file, then RMAN backs up the file as if the PROXY option had not been used. (Use the PROXY ONLY option to force RMAN to fail if a proxy copy cannot be performed.)

Control files are never backed up with proxy copy. If the PROXY option is specified on an operation backing up a control file, then it is silently ignored for the purposes of backing up the control file.

To create image copies and have them recorded in the RMAN repository, you run the RMAN BACKUP AS COPY command. Alternatively, you can configure the default backup type for disk as image copies. A database server session is used to create the copy. The server session also performs actions such as validating the blocks in the file and recording the image copy in the RMAN repository.

As with backup pieces, FORMAT variables are used to specify the names of image copies. The default format %U, which was explained in "About File Names for RMAN Backup Pieces", is defined differently for image copies. The following example shows the name for data file 2 generated by %U:

/d1/oracle/work/orcva/RDBMS/datafile/o1_mf_sysaux_2qylngm3_.dbf

When creating image copies, you can also name the output copies with the DB_FILE_NAME_CONVERT parameter of the BACKUP command. This parameter works identically to the DB_FILE_NAME_CONVERT initialization parameter. Pairs of file name prefixes are provided to change the names of the output files. If a file is not converted by any of the pairs, then RMAN uses the FORMAT specification: if no FORMAT is specified, then RMAN uses the default format %U.

BACKUP AS COPY 
  DB_FILE_NAME_CONVERT ('/maindisk/oradata/users',
                        '/backups/users_ts')
  TABLESPACE users;

RMAN can use image copies created by mechanisms outside of RMAN, such as native operating system file copy commands or third-party utilities that leave image copies of files on disk. This type of copy is known as a user-managed backup or operating system backup.

You can use the CATALOG command to inspect an existing image copy and enter its metadata into the RMAN repository. However, the CATALOG command does not do the following:

• Read all blocks in the data file copy to ensure there are no corruptions

• Guarantee that the image copy was correctly made in backup mode

After you catalog these files, you can use them with the RESTORE or SWITCH commands just as you can for RMAN-generated image copies.

Some sites store their data files on mirrored disk volumes, which permit the creation of image copies by breaking a mirror. After you have broken the mirror, you can notify RMAN of the existence of a new user-managed copy, thus making it eligible for a backup. You must notify RMAN when the copy is no longer available by using the CHANGE ... UNCATALOG command.

When backing up data files, archived redo log files, server parameter files, and control files into backup pieces, RMAN can create a duplexed backup set, producing up to four identical copies of each backup piece in the backup set on different backup destinations with one BACKUP command. Duplexing is not supported for backup operations that produce image copies.

You can use the COPIES parameter in the CONFIGURE, SET, or BACKUP commands to specify duplexing of backup sets when using the BACKUP command. RMAN can duplex backups to either disk or tape, but cannot duplex backups to tape and disk simultaneously. When backing up to tape, ensure that the number of copies does not exceed the number of available tape devices.

The FORMAT parameter of the BACKUP command specifies the destinations for duplexed backups. The following example creates three copies of the backup of data file 7:

BACKUP DEVICE TYPE DISK COPIES 3 DATAFILE 7 
  FORMAT '/disk1/%U','?/oradata/%U','?/%U';

RMAN places the first copy of each backup piece in /disk1, the second in ?/oradata, and the third in the Oracle home. RMAN does not produce three backup sets, each with a different unique backup set key. Rather, RMAN produces one backup set with a unique key, and generates three identical copies of each backup piece in the set.

You can use the BACKUP command to back up existing backup sets and image copies. Backing up existing backups enables you to make multiple, identical copies of RMAN backups.

The following sections provide more information about the methods of creating backups up backups:

• Backups of Backup Sets

• Backups of Image Copies

For non-CDBs, if CONFIGURE CONTROLFILE AUTOBACKUP is ON, then RMAN automatically backs up the control file and the current server parameter file (if used to start the database) after a successful BACKUP command. For CDBs, by default, the control file autobackup is turned on. If the database runs in ARCHIVELOG level, RMAN makes control file autobackups when a structural change to the database affects the contents of the control file.

The first channel allocated during the backup job creates the autobackup and places it into its own backup set. For autobackups after database structural changes, the server process associated with the structural change makes the backup.

If a server parameter file is in use by the database, then RMAN backs it up in the same backup set as the control file autobackup. After the autobackup completes, the database writes a message containing the complete path of the backup piece and the device type to the alert log located in the Automatic Diagnostic Repository (ADR).

The control file autobackup file name has a default format of %F for all device types, so that RMAN can determine the file location and restore it without a repository. You can specify a different format with the CONFIGURE CONTROLFILE AUTOBACKUP FORMAT command, but all autobackup formats must include the %F variable. If you do not use the default format, then during disaster recovery you must specify the format that was used to generate the autobackups. Otherwise, RMAN cannot restore the autobackup.

RMAN can create multilevel incremental backups. Each incremental level is denoted by a value of 0 or 1. A level 0 incremental backup, which is the base for subsequent incremental backups, copies all blocks containing data.

The only difference between a level 0 incremental backup and a full backup is that a full backup is never included in an incremental strategy. Thus, an incremental level 0 backup is a full backup that happens to be the parent of incremental backups whose level is greater than 0.

A level 1 incremental backup can be either of the following types:

• A differential incremental backup, which backs up all blocks changed after the most recent incremental backup at level 1 or 0

  See About Differential Incremental Backups.

• A cumulative incremental backup, which backs up all blocks changed after the most recent incremental backup at level 0

  See About Cumulative Incremental Backups.

Incremental backups are differential by default.

Incremental backups at level 0 can be either backup sets or image copies, but incremental backups at level 1 can only be backup sets.

The size of the backup file depends solely upon the number of blocks modified, the incremental backup level, and the type of incremental backup (differential or cumulative).

The block change tracking feature for incremental backups improves incremental backup performance by recording changed blocks in each data file in a block change tracking file. This file is a small binary file stored in the database area. RMAN tracks changed blocks as redo is generated.

If block change tracking is enabled, then RMAN uses the change tracking file to identify changed blocks for incremental backups, thus avoiding the need to scan every block in the data file. RMAN only uses block change tracking when the incremental level is greater than 0, because a level 0 incremental backup includes all blocks.

The following concepts are essential for understanding the algorithm that RMAN uses to make incremental backups:

• Checkpoint SCN

  Every data file has a data file checkpoint SCN, which you can view in V$DATAFILE.CHECKPOINT_CHANGE#. All changes with an SCN lower than this SCN are guaranteed to be in the file. When a level 0 incremental backup is restored, the restored data file contains the checkpoint SCN that it had when the level 0 was created. When a level 1 incremental backup is applied to a file, the checkpoint SCN of the file is advanced to the checkpoint SCN that the file had when the incremental level 1 backup was created.

• Incremental start SCN

  This SCN applies only to level 1 incremental backups. All blocks whose SCN is greater than or equal to the incremental start SCN are included in the backup. Blocks whose SCN is lower than the incremental start SCN are not included in the backup. The incremental start SCN is most often the checkpoint SCN of the parent of the level 1 backup.

• Block SCN

  Every data block in a data file records the SCN at which the most recent change was made to the block.

When RMAN makes a level 1 incremental backup of a file, RMAN reads the file, examines the SCN of every block, and backs up blocks whose SCN is greater than or equal to the incremental start SCN for this backup. If the backup is differential, then the incremental start SCN is the checkpoint SCN of the most recent level 1 backup. If the backup is cumulative, then the incremental start SCN is the checkpoint SCN of the most recent level 0 backup.

When block change tracking is enabled, RMAN uses bitmaps to avoid reading blocks that have not changed during the range from incremental start SCN to checkpoint SCN. RMAN still examines every block that is read and uses the SCN in the block to decide which blocks to include in the backup.

One consequence of the incremental backup algorithm is that RMAN applies all blocks containing changed data during recovery, even if the change is to an object created with the NOLOGGING option. Thus, if you restore a backup made before NOLOGGING changes were made, then incremental backups are the only way to recover these changes.

During media recovery, RMAN examines the restored files to determine whether it can recover them with an incremental backup. If it has a choice, then RMAN always chooses incremental backups over archived redo logs because applying changes at a block level is faster than applying redo.

RMAN does not need to restore a base incremental backup of a data file to apply incremental backups to the data file during recovery. For example, you can restore data file image copies and recover them with incremental backups.

When backing up to Zero Data Loss Recovery Appliance (Recovery Appliance), you can use the incremental-forever backup strategy to eliminate the need for creating recurring full backups. With the incremental-forever backup strategy, you need to create only one initial level 0 full backup and subsequent level 1 incremental backups. The initial backup and the subsequent incrementals must be RMAN backup sets and not image copies.

Note that the Recovery Appliance incremental-forever backup strategy is different from the incrementally updated backup strategy in a conventional RMAN setup. With RMAN, incrementally updated backups use an initial image copy, followed by incremental backups which are eventually merged into the full backup. Therefore, there is always at least one full image copy, a few incremental backups, and some archived redo logs.

Although Recovery Appliance supports other RMAN backup strategies, the recommended method for ongoing backups is the incremental-forever backup strategy.

A recovery window is a period that begins with the current time and extends backward in time to the point of recoverability. The point of recoverability is the earliest time for a hypothetical point-in-time recovery, that is, the earliest point to which you can recover following a media failure. For example, if you implement a recovery window of 1 week, then RMAN retains full backups and required incremental backups and archived logs so that the database can be recovered up to 7 days in the past. You implement this retention policy as follows:

CONFIGURE RETENTION POLICY TO RECOVERY WINDOW OF 7 DAYS;

This command ensures that for each data file, one backup that is older than the point of recoverability is retained. For example, if the recovery window is 7, then there must always exist one backup of each data file that satisfies the following condition:

SYSDATE - BACKUP CHECKPOINT TIME >= 7

All backups older than the most recent backup that satisfied this condition are obsolete.

Assume the retention policy illustrated in Figure 8-4. The retention policy has the following aspects:

• The recovery window is 7 days.

• Database backups are scheduled every two weeks on these days:

  • January 1

  • January 15

  • January 29

  • February 12

• The database runs in ARCHIVELOG mode, and archived logs are saved on disk only if needed for the retention policy.

Figure 8-4 Recovery Window, Part 1

Description of "Figure 8-4 Recovery Window, Part 1"

As illustrated in Figure 8-4, the current time is January 23 and the point of recoverability is January 16. Hence, the January 14 backup is needed for recovery, and so are the archived logs from log sequence 500 through 850. The logs before 500 and the January 1 backup are obsolete because they are not needed for recovery to a point within the window.

Assume the same scenario a week later, as depicted in Figure 8-5.

Figure 8-5 Recovery Window, Part 2

Description of "Figure 8-5 Recovery Window, Part 2"

In this scenario, the current time is January 30 and the point of recoverability is January 23. Note how the January 14 backup is not obsolete even though a more recent backup (January 28) exists in the recovery window. This situation occurs because restoring the January 28 backup does not enable you to recover to the earliest time in the window, January 23. To ensure recoverability to any point in the window, you must save the January 14 backup and all archived logs from sequence 500 to 1150.

In some cases using a recovery window can complicate disk space planning because the number of backups that must be retained is not constant and depends on the backup schedule. In contrast, a redundancy-based retention policy specifies how many backups of each data file must be retained. For example, you can configure a redundancy of 2 as follows:

CONFIGURE RETENTION POLICY TO REDUNDANCY 2;

The default retention policy is configured to REDUNDANCY 1.

You can run the REPORT OBSOLETE command to determine which backups are currently obsolete according to the retention policy. A companion command, DELETE OBSOLETE, deletes all files that are obsolete according to the retention policy. You can run DELETE OBSOLETE periodically to minimize space wasted by storing obsolete backups. For example, you can run DELETE OBSOLETE in a weekly script.

You can also override the configured retention policy by specifying the REDUNDANCY or RECOVERY WINDOW options on the REPORT or DELETE commands. Using DELETE OBSOLETE with a recovery window shorter than the configured recovery window effectively reduces the window of recoverability. For example, if the configured window is 14 days, but you execute DELETE OBSOLETE RECOVERY WINDOW OF 7 DAYS, then you no longer have the ability to recover to a time between 7 and 14 days ago.

The RMAN status OBSOLETE is always determined in reference to a retention policy. For example, if a database backup is considered OBSOLETE in the RMAN repository, then it is because it is either not needed for recovery to a point within the recovery window, or it is redundant.

If you configure a fast recovery area, then the database uses an internal algorithm to select files in the fast recovery area that are no longer needed to meet the configured retention policy. These backups have status OBSOLETE and are eligible for deletion to satisfy the disk quota rules. The retention policy is never violated when determining which files to delete from the fast recovery area to satisfy the disk quota rules.

There is one important difference between the fast recovery area rules for OBSOLETE status and the disk quota rules for deletion eligibility. Assume that archived logs 1000 through 2000, which are on disk, are needed for the current recovery window and so are not obsolete. If you back up these logs to tape, then the retention policy considers the disk logs as required, that is, not obsolete. Nevertheless, the fast recovery area disk quota algorithm considers the logs on disk as eligible for deletion because they have been backed up to tape. The logs on disk do not have OBSOLETE status in the repository, but they are eligible for deletion by the fast recovery area.