Transformation: move on-prem Oracle RMAN backups from tape to OCI Object Storage

#Why

Off-site copies without tape handling, immutable retention options, and the same backups can be restored on OCI for DR or migration.

#1. Prepare OCI

• A bucket (Standard tier) in the target region; consider a retention rule for immutability.
• A dedicated IAM user with an API signing key and a policy limited to that bucket:

Allow group 'Default'/'rman-backup' to manage objects in compartment backups where target.bucket.name = 'rman-prod'
Allow group 'Default'/'rman-backup' to read buckets in compartment backups

#2. Install the backup module

java -jar oci_install.jar -host https://objectstorage.eu-frankfurt-1.oraclecloud.com \
  -pvtKeyFile /home/oracle/.oci/oci_api_key.pem -pubFingerPrint aa:bb:cc:... \
  -uOCID ocid1.user.oc1..aaaa -tOCID ocid1.tenancy.oc1..aaaa \
  -walletDir $ORACLE_HOME/data/opcwallet -libDir $ORACLE_HOME/lib \
  -bucket rman-prod -configFile $ORACLE_HOME/dbs/opcORCL.ora

This creates the library (libopc.so), a config file and a wallet holding the credentials.

#3. Configure RMAN

CONFIGURE CHANNEL DEVICE TYPE 'SBT_TAPE' PARMS 'SBT_LIBRARY=/u01/app/oracle/product/19c/dbhome_1/lib/libopc.so, SBT_PARMS=(OPC_PFILE=/u01/app/oracle/product/19c/dbhome_1/dbs/opcORCL.ora)';
CONFIGURE DEFAULT DEVICE TYPE TO 'SBT_TAPE';
CONFIGURE BACKUP OPTIMIZATION ON;
CONFIGURE CONTROLFILE AUTOBACKUP ON;
CONFIGURE ENCRYPTION FOR DATABASE ON;
CONFIGURE COMPRESSION ALGORITHM 'MEDIUM';
CONFIGURE DEVICE TYPE 'SBT_TAPE' PARALLELISM 4 BACKUP TYPE TO COMPRESSED BACKUPSET;
CONFIGURE RETENTION POLICY TO RECOVERY WINDOW OF 30 DAYS;

Cloud backups must be encrypted. Use TDE-based (transparent) encryption or a password:

SET ENCRYPTION ON IDENTIFIED BY "<strong-password>" ONLY;   -- per session, if not using TDE

Store the password where your DR team can find it — without it the backups are useless.

#4. Back up

RUN {
  BACKUP INCREMENTAL LEVEL 0 DATABASE PLUS ARCHIVELOG DELETE INPUT;
  DELETE NOPROMPT OBSOLETE;
}

Typical schedule: weekly level 0, daily level 1, archive logs every 1–4 hours. Check that the archive log backup frequency matches your RPO.

#5. Long-term retention

For monthly/yearly backups kept for years, use KEEP backups and a bucket lifecycle rule (or the module's archive tier option) to move old objects to the Archive tier. Archive restores need a restore-from-archive step first and take hours, so keep recent backups in Standard.

#6. Test restores

RESTORE DATABASE VALIDATE;
RESTORE ARCHIVELOG FROM TIME 'SYSDATE-1' VALIDATE;

Quarterly, restore to a separate host (on-prem or an OCI VM): install the module there with the same wallet/config, restore the controlfile autobackup and the database, and record the time taken.

#7. Retire tape

Keep tapes until their retention expires; stop new tape jobs only after cloud backups and a restore test have succeeded.

#Checklist

• Bucket, least-privilege user and policy created
• Module installed; SBT channel configured
• Encryption on; password/TDE wallet safely stored
• Schedules meet RPO; obsolete backups deleted
• Restore validated and full restore tested