Deploying Veeam Oracle RMAN Plug-in from Veeam Server

Computer Discovery and Veeam Plug-in Deployment

For automated Plug-in installation, we can use Protection Group, in which we organize computers with databases that we want to protect. We can use automatic computer discovery and Plug-in installation. It works the same as for installing Veeam agent.

Note: I performed tests in a lab environment. Oracle DB 19c was simply installed on a VM with Rocky Linux 9.4. For simplicity, I used common (main) accounts instead of separate accounts for better security.

Creating Protection Group

Creating Protection Groups

Inventory – Physical Infrastructure – Create Protection Group
Name – each group must have a unique name

Type – Individual computers

Computers – Add – enter the server name or IP address and select (add) login credentials (SSH credentials)

Use the Test Now button to verify connection to the server.

Options
- set when to scan the Protection Group
- choose the distribution server
- if you don’t need it, don’t install the agent
- select installation of application plug-in and under Configure choose Oracle RMAN
- we can set automatic update (server restart should not be needed when installing the plug-in)

Review – displays a list of components for the distribution server, whether they are already installed or will be installed
Summary – if the server is untrusted, turn off Run discovery when I click Finish

Note: Since Veeam Backup & Replication version 12.1, it is possible to connect Linux using certificate authentication. Deploying Plug-in Using Pre-Installed Veeam Deployer Service

Plug-in Installation – Rescan Protection Group

Rescanning Protection Group

Installation occurs during Protection Group Rescan. We can trigger it manually.

Inventory – Physical Infrastructure – Create Protection Group
right-click on our Protection Group and select Rescan

During the process, Veeam components Installer service, Transport service and in our case RMAN Linux Plug-in will be installed and configured.

Application backup policy

Veeam primarily uses the term backup job – Backup Job. But somewhere, for example for a job managed by Veeam agent, the term backup policy – Backup Policy is used. For database backups on computers with Veeam Plug-in, the term Application Backup Policy is used.

Creating Oracle RMAN Backup Policy

Creating Oracle RMAN Backup Policy, Application Backup Policies

Home – Backup Job – Application – Oracle RMAN

Name – each job must have a unique name that suggests its purpose/content
Databases – the basis of the job is to determine which Oracle databases we will back up, we can select Protection Group, computers, Oracle home, Oracle databases (only computers where Oracle DB was detected are offered in the list), we can use Exclusions to omit certain objects

Storage – we select Repository (backup storage) and Retention Policy (how many recovery points or days we want to keep, pay attention to the CONTROL_FILE_RECORD_KEEP_TIME parameter on the Oracle server)
- Advanced – Backup – we select the backup mode for incremental backups, Differential backup – data changed since the last incremental data backup, Cumulative backup – data changed since the last full data backup, under Create level 0 backups periodically we plan performing full backups
- Advanced – Storage – we can enable data compression during backup (runs on the Oracle server) either using Veeam Data Mover (ZSTD algorithm) or Oracle RMAN
- Advanced – Notifications – setting notifications when the job is completed (we can set globally or customize for individual job, to be able to set on the job, it must be allowed globally, for example if we don’t allow Success globally, it won’t work when set on the job)
- Advanced – Oracle – we enter the number of data channels that Veeam Plug-in uses for parallel database backup

Database Processing – we set up processing of objects that we added in the Databases step (we can add contained lower-level objects here)
- we enter login credentials (Credentials) for DB backup
- we can enable deletion of archived redo logs (quite important for DBs in ARCHIVELOG mode), at the same time we set how often log backup should occur (1 to 480 minutes) and how many parallel channels will be used

Schedule – we can schedule regular task execution (the second option is to run manually)

Account for Oracle DB Backup

The account (Credentials) for database backup, which we set in the Database Processing step, is important. The dialog itself states that it must be an operating system user with SYSDBA privileges. More information in Permissions.

I have no experience with Oracle DB, so I tried to use the root and sys accounts, but only the oracle account worked. When using an incorrect account, Veeam ended with some error:

Failed to execute plug-in manager command: Oracle error has occurred. ORA-01017: invalid username/password; logon denied  

Failed to perform backup task Error: TCP stream was closed Failed to start 'RMANPluginManager' executable. Failed to create
'/opt/veeam/VeeamPluginforOracleRMAN/RMANPluginManager' agent. Failed to invoke rpc command

I encountered another error because my test DB was not in archive mode.

RMAN error: RMAN-03002: failure of backup plus archivelog command at 07/04/2025 15:55:16 RMAN-06149: cannot BACKUP DATABASE
 in NOARCHIVELOG mode

Oracle RMAN Backup Policy Behavior

We can find the created task under Jobs – Application Plug-ins. Its name is what we entered. The type is Oracle RMAN Backup, same as for tasks in Standalone Mode, but there’s a different icon here. The backup policy runs continuously and switches to Idle state. The database log backup is a separate task that runs concurrently with the database backup.

Backups are under Backups – Disk – Oracle RMAN – task name - server FQDN. A folder is created on the storage for each Veeam plug-in and inside a folder for each Backup Policy. The files are the same for both Managed Mode and Standalone Mode.

When backup is in progress, three different types of sessions run: Application Backup Policy, Oracle RMAN Backup, Application Log Backup.