1 Introduction to Oracle Secure Backup

Oracle Secure Backup Features

Oracle Secure Backup enables you to do the following:

• Centrally manage tape backup and restore operations of distributed, mixed-platform environments (see Oracle Secure Backup Installation Guide for supported machine architectures). You can access local and remote file systems and devices from any location in a network without using NFS or CIFS.

• Back up to and restore data from Oracle Cluster File System (OCFS) on Linux and Windows.

• Use wildcards and exclusion lists to specify what you want to back up.

• Perform multilevel incremental backups.

• Duplex database backups so that the same data stream goes to multiple devices. You can specify different media families or devices for each copy of the data.

• Create backups that span multiple volumes.

• Optimize tape resources with automatic drive sharing.

• Restore data rapidly. Oracle Secure Backup uses direct-to-block positioning and direct access restore to avoid unnecessarily reading tape blocks to locate files. Oracle Secure Backup maintains a record of the tape position of all backup data in its catalog for rapid retrieval.

• Maintain security and limit the users who are authorized to perform data management operations. By default, SSL is used for authentication and communication between hosts in the administrative domain.

Oracle Secure Backup and Recovery Manager

Recovery Manager (RMAN) is an Oracle Database-specific backup and recovery utility. RMAN is a built-in part of Oracle Database and backs up, restores, and recovers database files regardless of the type of disk storage used for these files.

RMAN knows and applies the complex rules that must be followed to recover Oracle databases. If your database backup strategy needs storage resources other than local disk, then you must use RMAN in conjunction with a general-purpose network backup tool such as Oracle Secure Backup.

Oracle Secure Backup can back up all types of files on the file system. Although Oracle Secure Backup has no specialized knowledge of database backup and recovery algorithms, it can serve as a media management layer for RMAN through the SBT interface. In this capacity, Oracle Secure Backup provides the same services for RMAN as other supported third-party SBT libraries. Oracle Secure Backup is better integrated with Oracle Enterprise Manager, however, than other media managers.

Table 1-1 describes differences between RMAN and Oracle Secure Backup in terms of the type of data backed up and the type of media used for backup storage.

Oracle Secure Backup Interfaces

Figure 1-1 shows the interfaces that you can use to access Oracle Secure Backup.

Figure 1-1 Interfaces to Oracle Secure Backup

Description of "Figure 1-1 Interfaces to Oracle Secure Backup"

Users interact with Oracle Secure Backup by means of one of the following tools:

• Oracle Secure Backup Web tool

  The Oracle Secure Backup Web tool is a browser-based GUI that enables you to configure an administrative domain, manage the backup and restore of file system data, and browse the backup catalog.

  The Web tool utilizes an Apache Web server, which runs on the administrative server. As explained in "Using the Web Tool", you can access the Web tool from any Web browser that can connect to this server.

• Oracle Secure Backup command-line interface (obtool)

  Oracle Secure Backup provides a command-line program called obtool as an alternative to the Web tool. You can log in to the administrative domain through obtool to back up and restore file system data and to perform configuration and administration tasks.

  As explained in "Using obtool", you can run the obtool utility on any host in the administrative domain on which Oracle Secure Backup is installed.

• Oracle Enterprise Manager Database Control and Grid Control

  Oracle Enterprise Manager is a set of GUI-based tools for managing the Oracle environment. You can use Enterprise Manager to schedule and perform RMAN backups through the Oracle Secure Backup SBT interface. You can also perform administrative tasks such as managing media and devices within the Oracle Secure Backup administrative domain. The Enterprise Manager console includes a link to the Oracle Secure Backup Web tool.

  As explained in "Using Oracle Enterprise Manager", you can use Enterprise Manager Database Control to back up a database on the administrative server. You can run Enterprise Manager Grid Control on any database host within the administrative domain and use this interface to manage all database backup and restore operations.

• Recovery Manager command-line interface (rman)

  You can use the RMAN command-line interface to configure and initiate backup and restore operations that use the Oracle Secure Backup SBT interface. The RMAN utility is located in the bin subdirectory of an Oracle home.

  As explained in "Interfaces for Managing Database Backup and Recovery", you can run the RMAN command-line client on any database host so long as it can connect to the target database. For RMAN to make backups to Oracle Secure Backup, the Oracle Secure Backup SBT library must reside on the same host as the target database.

Host Access Modes

Communications with a host in an administrative domain occur through one of the following access modes:

• Primary

  In primary access mode, Oracle Secure Backup is installed on a host. The programming components of Oracle Secure Backup are running in the background as daemons. The daemons actively participate in managing backup and restore operations. Typically, an Oracle database resides on a host accessed through this mode.

  Note:

  In the Enterprise Manager GUI, primary access mode is referred to as native access mode. In the Oracle Secure Backup Web tool and the output of some obtool commands such as lshost, primary mode is referred to as OB access mode.

• NDMP

  An NDMP host is a storage appliance from third-party vendors such as Network Appliance, Mirapoint, or DinoStor. An NDMP host uses a vendor-specific implementation of the NDMP protocol to back up and restore file systems. Oracle Secure Backup software is not installed on an NDMP host, but is accessible to Oracle Secure Backup through NDMP.

In Example 1-1, the lshost command in obtool displays the hosts in an administrative domain. The command indicates the access mode of each host—NDMP or primary (ob)—in parentheses.

ob> lshost
br_filer         client                            (via NDMP) in service
stadv07          admin,mediaserver,client          (via OB)   in service

As explained in "Oracle Secure Backup and NDMP", Oracle Secure Backup uses NDMP for data transfer among hosts regardless of whether a host is accessed through the primary or NDMP modes. For example, a Windows administrative server uses NDMP to exchange data with a NetApp filer and a Linux client.

Administrative Data

Oracle Secure Backup organizes information about the administrative domain as a hierarchy of files in the Oracle Secure Backup home on the administrative server. The Oracle Secure Backup home is the directory in which Oracle Secure Backup is installed.

Figure 1-4 shows the directory structure of an Oracle Secure Backup home. This directory structure is the same for all platforms, but the default home is /usr/local/oracle/backup for UNIX and Linux and C:\Program Files\Oracle\Backup for Windows.

Figure 1-4 Directories on the Administrative Server

Description of "Figure 1-4 Directories on the Administrative Server"

The administrative data includes configuration data about domain-wide entities such as classes, devices, media families, and so on. As shown in Figure 1-4, config contains several subdirectories, each of which represents an object that Oracle Secure Backup maintains. In each object directory, Oracle Secure Backup maintains files describing the characteristics of the corresponding object.

The Oracle Secure Backup catalog contains backup-related information. The admin/history/host directory contains subdirectories named after the hosts in the administrative domain; each of these subdirectories contains a file in which the catalog data is stored. Oracle Secure Backup also maintains backup sections, backup pieces, and volumes catalogs in the admin/state/general subdirectory.

The Web tool and obtool are the interfaces by which you access catalogs and configuration data. Only in exceptional circumstances do you access the administrative data directly on the file system.

Oracle Secure Backup Users and Passwords

Oracle Secure Backup stores information pertaining to Oracle Secure Backup users and rights on the administrative server, enabling Oracle Secure Backup to maintain a consistent user identity across the administrative domain.

Each user of an Oracle Secure Backup domain has an account and an encrypted password stored on the administrative server. An operating system user can enter the Oracle Secure Backup username and password in the Web tool or obtool. The client program sends the password over an encrypted SSL connection to the administrative server for authentication.

Oracle Secure Backup Classes and Rights

An Oracle Secure Backup class defines a set of rights granted to an Oracle Secure Backup user. A class is similar to a UNIX group, but it defines a finer granularity of access rights tailored to the needs of Oracle Secure Backup. As shown in Figure 1-5, you can assign multiple users to a class, each of whom is a member of only one class.

Figure 1-5 Classes and Rights

Description of "Figure 1-5 Classes and Rights"

The following classes are key to understanding Oracle Secure Backup user rights:

• admin

  This class is used for overall administration of a domain. The admin class has all the rights needed to modify domain configurations and perform backup and restore operations.

• operator

  This class is used for standard day-to-day operations. The operator class lacks configuration rights but has all the rights needed for backup and restore operations. It also allows the user to query the state of all primary and secondary storage devices and to control the state of these devices.

• oracle

  This class, which is similar to the operator class, has rights enabling users to modify Oracle database configuration settings as well as to perform Oracle database backups. Typically, class members are Oracle Secure Backup users that are mapped to operating system accounts of Oracle database installations.

• user

  This class is assigned to specific users and gives them permission to interact in a limited way with their domains. This class is reserved for users who need to browse their own data within the Oracle Secure Backup catalog and perform user-based restore operations.

• reader

  This class enables Oracle Secure Backup users to browse the catalog. Readers are only permitted to modify the given name and password for their Oracle Secure Backup user accounts.