PK
DAoa, mimetypeapplication/epub+zipPK DA iTunesMetadata.plistV
This chapter explains how to restore and recover individual data blocks within a data file. This chapter contains the following topics:
See Also:
|
This section explains the purpose and basic concepts of block media recovery.
You can use block media recovery to recover one or more corrupt data blocks within a data file. Block media recovery provides the following advantages over data file media recovery:
Lowers the mean time to recover (MTTR) because only blocks needing recovery are restored and recovered
Enables affected data files to remain online during recovery
Without block media recovery, if even a single block is corrupt, then you must take the data file offline and restore a backup of the data file. You must apply all redo generated for the data file after the backup was created. The entire file is unavailable until media recovery completes. With block media recovery, only the blocks actually being recovered are unavailable during the recovery.
Block media recovery is most useful for physical corruption problems that involve a small, well-known number of blocks. Block-level data loss usually results from intermittent, random I/O errors that do not cause widespread data loss, and memory corruptions that are written to disk. Block media recovery is not intended for cases where the extent of data loss or corruption is unknown and the entire data file requires recovery. In such cases, data file media recovery is the best solution.
Usually, the database marks a block as media corrupt and then writes it to disk when the corruption is first encountered. No subsequent read of the block is successful until the block is recovered. You can perform block recovery only on blocks that are marked corrupt or that fail a corruption check.
If the database on which the corruption occurs is associated with a real-time query physical standby database, then the database automatically attempts to perform block media recovery. The primary database searches for good copies of blocks on the standby database and, if they are found, repairs the blocks with no impact to the query that encountered the corrupt block. The Oracle Database physical block corruption message (ORA-1578
) is displayed only if the database cannot repair the corruption.
Whenever block corruption has been automatically detected, you can perform block media recovery manually with the RECOVER ... BLOCK
command. By default, RMAN first searches for good blocks in the real-time query physical standby database, then flashback logs and then blocks in full or level 0 incremental backups.
Note: For block media recovery to work automatically, the physical standby database must be in real-time query mode. An Oracle Active Data Guard license is required. |
If a corrupt data block is discovered on a real-time query physical standby database, the server attempts to repair the corruption by obtaining a copy of the block from the primary database. The repair is performed in the background, enabling subsequent queries to succeed if the repair is successful. Automatic block repair is attempted if the following database initialization parameters are configured on the standby database as described:
The LOG_ARCHIVE_CONFIG
parameter is configured with a DG_CONFIG
list and a LOG_ARCHIVE_DEST_n
parameter is configured for the primary database with the DB_UNIQUE_NAME
attribute
or
The FAL_SERVER
parameter is configured and its value contains an Oracle Net service name for the primary database
Note: If a corrupt block is detected during validation, such as by the RMANVALIDATE command, then recovery is not initiated automatically. |
See Also:
|
The V$DATABASE_BLOCK_CORRUPTION
view displays blocks marked corrupt by database components such as RMAN, ANALYZE
, dbv
, and SQL queries. The following types of corruption result in the addition of rows to this view:
Physical corruption (sometimes called media corruption)
The database does not recognize the block: the checksum is invalid, the block contains all zeros, or the block header is corrupt.
Physical corruption checking is enabled by default. You can turn off checksum checking by specifying the NOCHECKSUM
option of the BACKUP
command, but other physical consistency checks, such as checks of the block headers and footers, cannot be disabled.
Logical corruption
The block has a valid checksum, the header and footer match, and so on, but the contents are logically inconsistent. Block media recovery may not be able to repair all logical block corruptions. In these cases, alternate recovery methods, such as tablespace point-in-time recovery, or dropping and re-creating the affected objects, may repair the corruption.
Logical corruption checking is disabled by default. You can turn it on by specifying the CHECK
LOGICAL
option of the BACKUP
, RESTORE
, RECOVER
, and VALIDATE
commands.
The database can detect some corruptions by validating relationships between blocks and segments, but cannot detect them by a check of an individual block. The V$DATABASE_BLOCK_CORRUPTION
view does not record at this level of granularity.
Like data file media recovery, block media recovery cannot generally survive a missing or inaccessible archived log, although it attempts restore failover when looking for usable copies of archived redo log files, as described in "Restore Failover". Also, block media recovery cannot survive physical redo corruptions that result in checksum failure. However, block media recovery can survive gaps in the redo stream if the missing or corrupt redo records do not affect the blocks being recovered. Whereas data file recovery requires an unbroken series of redo changes from the beginning of recovery to the end, block media recovery only requires an unbroken set of redo changes for the blocks being recovered.
Note: Each block is recovered independently during block media recovery, so recovery may be successful for a subset of blocks. |
When RMAN first detects missing or corrupt redo records during block media recovery, it does not immediately signal an error because the block undergoing recovery may create one later in the redo stream. When a block is re-created, all previous redo for that block becomes irrelevant because the redo applies to an old incarnation of the block. For example, the database creates a new a block when users drop or truncate a table and then use the block for other data.
Assume that media recovery is performed on block 13 as depicted in Figure 19-1.
Figure 19-1 Performing RMAN Media Recovery
After block recovery begins, RMAN discovers that change 120 is missing from the redo stream, either because the log block is corrupt or because the log cannot be found. RMAN continues recovery assuming that block 13 will be re-created later in the redo stream. Assume that in change 140 a user drops the table employees
stored in block 13, allocates a new table in this block, and inserts data into the new table. At this point, the database formats block 13 as a new block. Recovery can now proceed with this block even though some redo preceding the recreation operation was missing.
The following prerequisites apply to the RECOVER ... BLOCK
command:
The target database must run in ARCHIVELOG
mode and be open or mounted with a current control file.
If the target database is a standby database, then it must be in a consistent state, recovery cannot be in session, and the backup must be older than the corrupted file.
The backups of the data files containing the corrupt blocks must be full or level 0 backups and not proxy copies.
If only proxy copy backups exist, then you can restore them to a nondefault location on disk, in which case RMAN considers them data file copies and searches them for blocks during block media recovery.
RMAN can use only archived redo logs for the recovery.
RMAN cannot use level 1 incremental backups. Block media recovery cannot survive a missing or inaccessible archived redo log, although it can sometimes survive missing redo records.
Flashback Database must be enabled on the target database for RMAN to search the flashback logs for good copies of corrupt blocks.
If flashback logging is enabled and contains older, uncorrupted versions of the corrupt blocks, then RMAN can use these blocks, possibly speeding up the recovery.
The target database must be associated with a real-time query physical standby database for RMAN to search the database for good copies of corrupt blocks.
Typically, block corruption is reported in the following locations:
Results of the LIST FAILURE
, VALIDATE
, or BACKUP ... VALIDATE
command
Error messages in standard output
The alert log
User trace files
Results of the SQL commands ANALYZE
TABLE
and ANALYZE
INDEX
Results of the DBVERIFY utility
Third-party media management output
For example, you may discover the following messages in a user trace file:
ORA-01578: ORACLE data block corrupted (file # 7, block # 3) ORA-01110: data file 7: '/oracle/oradata/trgt/tools01.dbf' ORA-01578: ORACLE data block corrupted (file # 2, block # 235) ORA-01110: data file 2: '/oracle/oradata/trgt/undotbs01.dbf'
In the following procedure, you identify the blocks that require recovery and then use any available backup to restore and recover these blocks.
To recover specific data blocks:
Obtain the data file numbers and block numbers of the corrupted blocks.
The easiest way to locate trace files and the alert log is to connect SQL*Plus to the target database and execute the following query:
SELECT NAME, VALUE FROM V$DIAG_INFO;
Start RMAN and connect to the target database, which must be mounted or open.
Run the SHOW ALL
command to confirm that the appropriate channels are preconfigured.
Run the RECOVER ... BLOCK
command at the RMAN prompt, specifying the file and block numbers for the corrupted blocks.
The following example recovers two blocks.
RECOVER DATAFILE 8 BLOCK 13 DATAFILE 2 BLOCK 19;
You can also specify various options to control RMAN behavior. The following example indicates that only backups with the tag mondayam
are used when searching for blocks. You could use the FROM BACKUPSET
option to restrict the type of backup that RMAN searches, or the EXCLUDE FLASHBACK LOG
option to restrict RMAN from searching the flashback logs.
RECOVER DATAFILE 8 BLOCK 13 DATAFILE 2 BLOCK 199 FROM TAG mondayam;
In this scenario, RMAN automatically recovers all blocks listed in the V$DATABASE_BLOCK_CORRUPTION
view.
To recover all blocks logged in V$DATABASE_BLOCK_CORRUPTION:
Start SQL*Plus and connect to the target database.
Query V$DATABASE_BLOCK_CORRUPTION
to determine whether corrupt blocks exist. For example, execute the following statement:
SQL> SELECT * FROM V$DATABASE_BLOCK_CORRUPTION;
Start RMAN and connect to the target database.
Recover all blocks marked corrupt in V$DATABASE_BLOCK_CORRUPTION
.
The following command repairs all physically corrupted blocks recorded in the view:
RMAN> RECOVER CORRUPTION LIST;
After the blocks are recovered, the database removes them from V$DATABASE_BLOCK_CORRUPTION
.
See Also: Oracle Database Backup and Recovery Reference to learn about theRECOVER ... BLOCK command |
This chapter explains how to manage an RMAN recovery catalog. The catalog is a database schema that contains the RMAN repository data for one or more target databases. This chapter contains the following topics:
See Also:
|
This section explains the basic concepts related to managing a recovery catalog.
A recovery catalog is a database schema used by RMAN to store metadata about one or more Oracle databases. Typically, you store the catalog in a dedicated database. A recovery catalog provides the following benefits:
A recovery catalog creates redundancy for the RMAN repository stored in the control file of each target database. The recovery catalog serves as a secondary metadata repository. If the target control file and all backups are lost, then the RMAN metadata still exists in the recovery catalog.
A recovery catalog centralizes metadata for all your target databases. Storing the metadata in a single place makes reporting and administration tasks easier to perform.
A recovery catalog can store metadata history much longer than the control file. This capability is useful if you must do a recovery that goes further back in time than the history in the control file. The added complexity of managing a recovery catalog database can be offset by the convenience of having the extended backup history available.
Some RMAN features function only when you use a recovery catalog. For example, you can store RMAN scripts in a recovery catalog. The chief advantage of a stored script is that it is available to any RMAN client that can connect to the target database and recovery catalog. Command files are only available if the RMAN client has access to the file system on which they are stored.
A recovery catalog is required when you use RMAN in a Data Guard environment. By storing backup metadata for all primary and standby databases, the catalog enables you to offload backup tasks to one standby database while enabling you to restore backups on other databases in the environment.
The recovery catalog contains metadata about RMAN operations for each registered target database. When RMAN is connected to a recovery catalog, RMAN obtains its metadata exclusively from the catalog. The catalog includes the following types of metadata:
Data file and archived redo log backup sets and backup pieces
Data file copies
Archived redo logs and their copies
Database structure (tablespaces and datafiles)
Stored scripts, which are named user-created sequences of RMAN commands
Persistent RMAN configuration settings
The process of enrolling of a database in a recovery catalog for RMAN use is called registration. The recommended practice is to register every target database in your environment in a single recovery catalog. For example, you can register databases prod1
, prod2
, and prod3
in a single catalog owned by catowner
in the database catdb
.
The owner of a centralized recovery catalog, which is also called the base recovery catalog, can grant or revoke restricted access to the catalog to other database users. Each restricted user has full read/write access to his own metadata, which is called a virtual private catalog. The RMAN metadata is stored in the schema of the virtual private catalog owner. The owner of the base recovery catalog determines which objects each virtual private catalog user can access.
You can use a recovery catalog in an environment in which you use or have used different versions of Oracle Database. As a result, your environment can have different versions of the RMAN client, recovery catalog database, recovery catalog schema, and target database. "Importing and Moving a Recovery Catalog" explains how to merge multiple recovery catalog schemas into one.
For RMAN operations such as backup, restore, and crosscheck, RMAN always first updates the control file and then propagates the metadata to the recovery catalog. This flow of metadata from the mounted control file to the recovery catalog, which is known as recovery catalog resynchronization, ensures that the metadata that RMAN obtains from the control file is current.
You can use a stored script as an alternative to a command file for managing frequently used sequences of RMAN commands. The script is stored in the recovery catalog rather than on the file system.
A local stored script is associated with the target database to which RMAN is connected when the script is created, and can only be executed when you are connected to this target database. A global stored script can be run against any database registered in the recovery catalog. A virtual private catalog user has read-only access to global scripts. Creating or updating global scripts must be done while connected to the base recovery catalog.
As explained in "RMAN in a Data Guard Environment", you must use a recovery catalog to manage RMAN metadata for all physical databases, both primary and standby databases, in the Data Guard environment. RMAN uses the recovery catalog as the single source of truth for the Data Guard environment.
RMAN can use the recovery catalog to update a primary or standby control file in a reverse resynchronization. In this case, the metadata flows from the catalog to the control file rather than the other way around. RMAN automatically performs resynchronizations in most situations in which they are needed. Thus, you should not need to use the RESYNC
command to manually resynchronize very often.
See Also: Oracle Data Guard Concepts and Administration to learn how to configure the RMAN environment for use with a standby database |
The basic steps for setting up a recovery catalog for use by RMAN are as follows:
Create the recovery catalog.
"Creating a Recovery Catalog" explains how to perform this task.
Register your target databases in the recovery catalog.
This step enables RMAN to store metadata for the target databases in the recovery catalog. "Registering a Database in the Recovery Catalog" explains this task.
If needed, catalog any older backups whose records are no longer stored in the target control file.
"Cataloging Backups in the Recovery Catalog" explains how to perform this task.
If needed, create virtual private catalogs for specific users and determine the metadata to which they are permitted access.
"Creating and Managing Virtual Private Catalogs" explains how to perform this task.
Protect the recovery catalog by including it in your backup and recovery strategy.
"Protecting the Recovery Catalog" explains how to back up and recover the catalog and increase its availability.
The remainder of the chapter explains how to manage the recovery catalog after it is operational. You can perform the following tasks:
"Managing Stored Scripts" explains how to store RMAN scripts in the recovery catalog and manage them.
Chapter 11, "Reporting on RMAN Operations" explains how to report on RMAN operations. You can use the LIST
and REPORT
commands with or without a recovery catalog. "Querying Recovery Catalog Views" explains how to report on RMAN operations with fixed views in the recovery catalog.
"Maintaining a Recovery Catalog" explains a variety of tasks for ongoing recovery catalog maintenance, including how to import one recovery catalog into another recovery catalog.
If you no longer want to maintain a recovery catalog, then see "Dropping a Recovery Catalog".
This section explains the phases of recovery catalog creation. This section contains the following topics:
When you use a recovery catalog, RMAN requires that you maintain a recovery catalog schema. The recovery catalog is stored in the default tablespace of the schema. The SYS
user cannot be the owner of the recovery catalog.
Decide which database you will use to install the recovery catalog schema, and also how you will back up this database. Also, decide whether to operate the catalog database in ARCHIVELOG
mode, which is recommended.
Note: Do not use the target database to be backed up as the database for the recovery catalog. The recovery catalog must be protected if the target database is lost. |
You must allocate space to be used by the catalog schema. The size of the recovery catalog schema depends upon the number of databases monitored by the catalog. The schema also grows as the number of archived redo log files and backups for each database increases. Finally, if you use RMAN stored scripts stored in the catalog, some space must be allocated for those scripts.
For example, assume that the trgt
database has 100 files, and that you back up the database once a day, producing 50 backup sets containing 1 backup piece each. If you assume that each row in the backup piece table uses the maximum amount of space, then one daily backup consumes less than 170 kilobytes in the recovery catalog. So, if you back up once a day for a year, then the total storage in this period is about 62 megabytes. Assume approximately the same amount for archived logs. Thus, the worst case is about 120 megabytes for a year for metadata storage. For a more typical case in which only a portion of the backup piece row space is used, 15 MB for each year is realistic.
If you plan to register multiple databases in your recovery catalog, then remember to add up the space required for each one based on the previous calculation to arrive at a total size for the default tablespace of the recovery catalog schema.
If you are creating your recovery catalog in an existing database, then add enough room to hold the default tablespace for the recovery catalog schema. If you are creating a new database to hold your recovery catalog, then in addition to the space for the recovery catalog schema itself, allow space for other files in the recovery catalog database:
SYSTEM
and SYSAUX
tablespaces
Temporary tablespaces
Undo tablespaces
Online redo log files
Most of the space used in the recovery catalog database is devoted to supporting tablespaces, for example, the SYSTEM
, temporary, and undo tablespaces. Table 13-1 describes typical space requirements.
Table 13-1 Typical Recovery Catalog Space Requirements for 1 Year
Type of Space | Space Requirement |
---|---|
|
90 MB |
Temp tablespace |
5 MB |
Rollback or undo tablespace |
5 MB |
Recovery catalog tablespace |
15 MB for each database registered in the recovery catalog |
Online redo logs |
1 MB each (three groups, each with two members) |
Caution: Ensure that the recovery catalog and target databases do not reside on the same disk. If both your recovery catalog and your target database suffer hard disk failure, then your recovery process is much more difficult. If possible, take other measures as well to eliminate common points of failure between your recovery catalog database and the databases that you are backing up. |
After choosing the recovery catalog database and creating the necessary space, you are ready to create the owner of the recovery catalog and grant this user necessary privileges. Assume the following background information for the instructions in the following sections:
User SYS
has SYSDBA
privileges on the recovery catalog database catdb
.
A tablespace called tools
in the recovery catalog database catdb
stores the recovery catalog. If you use an RMAN reserved word as a tablespace name, you must enclose it in quotes and put it in uppercase. (See Oracle Database Backup and Recovery Reference for a list of RMAN reserved words.)
A tablespace called temp
exists in the recovery catalog database.
To create the recovery catalog schema in the recovery catalog database:
Start SQL*Plus and connect with administrator privileges to the database containing the recovery catalog. In this example, the database is catdb
.
Create a user and schema for the recovery catalog. For example, you could enter the following SQL statement (replacing password with a user-defined password):
CREATE USER rman IDENTIFIED BY password
TEMPORARY TABLESPACE temp
DEFAULT TABLESPACE tools
QUOTA UNLIMITED ON tools;
Grant the RECOVERY_CATALOG_OWNER
role to the schema owner. This role provides the user with all privileges required to maintain and query the recovery catalog.
GRANT RECOVERY_CATALOG_OWNER TO rman;
After creating the catalog owner, create the catalog tables with the RMAN CREATE
CATALOG
command. The command creates the catalog in the default tablespace of the catalog owner.
To create the recovery catalog:
Start RMAN and connect to the database that will contain the catalog. Connect to the database as the recovery catalog owner.
Run the CREATE
CATALOG
command to create the catalog. The creation of the catalog can take several minutes. If the catalog tablespace is this user's default tablespace, then you can run the following command:
RMAN> CREATE CATALOG;
You can specify the tablespace name for the catalog in the CREATE
CATALOG
command. For example:
RMAN> CREATE CATALOG TABLESPACE cat_tbs;
Note: If the tablespace name that you want to use for the recovery catalog is an RMAN reserved word, then it must be uppercase and enclosed in quotes. For example:CREATE CATALOG TABLESPACE 'CATALOG'; |
You can check the results by using SQL*Plus to query the recovery catalog to see which tables were created:
SQL> SELECT TABLE_NAME FROM USER_TABLES;
See Also: Oracle Database SQL Language Reference for the SQL syntax for theGRANT and CREATE USER statements, and Oracle Database Backup and Recovery Reference for CREATE CATALOG command syntax |
This section describes how to maintain target database records in the recovery catalog. It contains the following sections:
The process of enrolling of a target database in a recovery catalog is called registration. If a target database is not registered in the recovery catalog, then RMAN cannot use the catalog to store metadata for operations on this database. You can still perform RMAN operations on an unregistered database: RMAN always stores its metadata in the control file of the target database.
If you are not using the recovery catalog in a Data Guard environment, then use the REGISTER
command to register each database. Each database must have a unique DBID. If you use the RMAN DUPLICATE
command or the CREATE DATABASE
statement in SQL, then the database is assigned a unique DBID automatically. If you create a database by other means, then the copied database may have the same DBID as its source database. You can change the DBID with the DBNEWID
utility so that you can register the source and copy databases in the same catalog.
You can use the UNREGISTER
command to unregister a database from the recovery catalog.
In a Data Guard environment, the primary and standby databases share the same DBID and database name. To be eligible for registration in the recovery catalog, each database in the Data Guard environment must have different DB_UNIQUE_NAME
values. The DB_UNIQUE_NAME
parameter for a database is set in its initialization parameter file.
If you use RMAN in a Data Guard environment, then you can use the REGISTER DATABASE
command only for the primary database. You can use the following techniques to register a standby database in the recovery catalog:
When you connect to a standby database as TARGET
, RMAN automatically registers the database in the recovery catalog.
When you run the CONFIGURE DB_UNIQUE_NAME
command for a standby database that is not known to the recovery catalog, RMAN automatically registers this standby database if its primary database is registered.
See Also:
|
The first step in using a recovery catalog with a target database is registering the ta rget database in the recovery catalog. If you use the catalog in a Data Guard environment, then you can only register the primary database in this way.
Use the following procedure:
Start RMAN and connect to a target database and recovery catalog. The recovery catalog database must be open.
For example, issue the following command to connect to the catalog database with the net service name catdb
as user rman
(who owns the catalog schema):
% rman TARGET / CATALOG rman@catdb
If the target database is not mounted, then mount or open it:
STARTUP MOUNT;
Register the target database in the connected recovery catalog:
REGISTER DATABASE;
RMAN creates rows in the catalog tables to contain information about the target database, then copies all pertinent data about the target database from the control file into the catalog, synchronizing the catalog with the control file.
Verify that the registration was successful by running REPORT
SCHEMA
:
REPORT SCHEMA; Report of database schema File Size(MB) Tablespace RB segs Datafile Name ---- ---------- ---------------- ------- ------------------- 1 307200 SYSTEM NO /oracle/oradata/trgt/system01.dbf 2 20480 UNDOTBS YES /oracle/oradata/trgt/undotbs01.dbf 3 10240 CWMLITE NO /oracle/oradata/trgt/cwmlite01.dbf 4 10240 DRSYS NO /oracle/oradata/trgt/drsys01.dbf 5 10240 EXAMPLE NO /oracle/oradata/trgt/example01.dbf 6 10240 INDX NO /oracle/oradata/trgt/indx01.dbf 7 10240 TOOLS NO /oracle/oradata/trgt/tools01.dbf 8 10240 USERS NO /oracle/oradata/trgt/users01.dbf
If you have data file copies, backup pieces, or archived logs on disk, then you can catalog them in the recovery catalog with the CATALOG
command. When using a recovery catalog, cataloging older backups that have aged out of the control file lets RMAN use the older backups during restore operations. The following commands illustrate this technique:
CATALOG DATAFILECOPY '/disk1/old_datafiles/01_01_2003/users01.dbf'; CATALOG ARCHIVELOG '/disk1/arch_logs/archive1_731.dbf', '/disk1/arch_logs/archive1_732.dbf'; CATALOG BACKUPPIECE '/disk1/backups/backup_820.bkp';
You can also catalog multiple backup files in a directory at once by using the CATALOG START WITH
command, as shown in the following example:
CATALOG START WITH '/disk1/backups/';
RMAN lists the files to be added to the RMAN repository and prompts for confirmation before adding the backups. Be careful when creating your prefix with CATALOG START WITH
. RMAN scans all paths for all files on disk that begin with the specified prefix. The prefix is not just a directory name. Using the wrong prefix can cause the cataloging of the wrong set of files.
For example, assume that a group of directories /disk1/backups
, /disk1/backups-year2003
, /disk1/backupsets
, and /disk1/backupsets/test
and so on, all contain backup files. The following command catalogs all files in all of these directories, because /disk1/backups
is a prefix for the paths for all of these directories:
CATALOG START WITH '/disk1/backups';
To catalog only backups in the /disk1/backups
directory, the correct command would be as follows:
CATALOG START WITH '/disk1/backups/';
See Also:
|
By default, all of the users of an RMAN recovery catalog have full privileges to insert, update, and delete any metadata in the catalog. For example, if the administrators of two unrelated databases share the same recovery catalog, each administrator could, whether inadvertently or maliciously, destroy catalog data for the other's database. In many enterprises, this situation is tolerated because the same people manage many different databases and also manage the recovery catalog. But in other enterprises where clear separation of duty exists between administrators of various databases, and between the DBA and the administrator of the recovery catalog, you may desire to restrict each database administrator to modify only backup metadata belonging to those databases that they are responsible for, while still keeping the benefits of a single, centrally-managed, RMAN recovery catalog. This goal can be achieved by implementing virtual private catalogs.
Every 11g recovery catalog supports virtual private catalogs, but they are not used unless explicitly created. There is no restriction to the number of virtual private catalogs that can created beneath one recovery catalog. Each virtual private catalog is owned by a database schema user which is different than the user who owns the recovery catalog.
After creating one or more virtual private catalogs, using the directions that follow, the administrator for the recovery catalog grants each virtual private catalog the privilege to use that catalog for one or more databases that are currently registered in the recovery catalog. The administrator of the recovery catalog can also grant the privilege to register new databases while using a virtual private catalog.
Note: Every virtual private catalog has access to all global stored scripts and those non-global stored scripts that belong to those databases for which this virtual private catalog has privileges. Virtual private catalogs cannot access non-global stored scripts that belong to databases that they do not have privileges for, and they cannot create global stored scripts. |
The basic steps for creating a virtual private catalog are as follows:
Create the database user who will own the virtual private catalog (if this user does not exist) and grant this user access privileges.
This task is described in "Creating and Granting Privileges to a Virtual Private Catalog Owner".
Create the virtual private catalog.
This task is described in "Creating a Virtual Private Catalog".
After the virtual private catalog is created, you can revoke catalog access privileges as necessary. This task is described in "Revoking Privileges from a Virtual Private Catalog Owner". "Dropping a Virtual Private Catalog" explains how to drop a virtual private catalog.
If the recovery catalog is a virtual private catalog, then the RMAN client connecting to it must be at patch level 10.1.0.6 or 10.2.0.3. Oracle9i RMAN clients cannot connect to a virtual private catalog. This version restriction does not affect RMAN client connections to an Oracle Database 11g base recovery catalog, even if it has some virtual private catalog users.
See Also: Oracle Database Backup and Recovery Reference for details about RMAN version compatibility |
This section assumes that you created the base recovery catalog.
Assume that the following databases are registered in the base recovery catalog: prod1
, prod2
, and prod3
. The database user who owns the base recovery catalog is catowner
. You want to create database user vpc1
and grant this user access privileges only to prod1
and prod2
. By default, a virtual private catalog owner has no access to the base recovery catalog.
To create and grant privileges to a virtual private catalog owner:
Start SQL*Plus and connect to the recovery catalog database with administrator privileges.
If the user that will own the virtual private catalog does not exist, then create the user.
For example, if you want to create database user vpc1
to own the catalog, then you could execute the following command (replacing password with a user-defined password):
SQL> CREATE USER vpc1 IDENTIFIED BY password
2 DEFAULT TABLESPACE vpcusers
3 QUOTA UNLIMITED ON vpcusers;
Grant the RECOVERY_CATALOG_OWNER
role to the database user that will own the virtual private catalog, and then exit SQL*Plus.
The following example grants the role to user vpc1
:
SQL> GRANT recovery_catalog_owner TO vpc1; SQL> EXIT;
Start RMAN and connect to the recovery catalog database as the base recovery catalog owner (not the virtual private catalog owner).
The following example connects to the base recovery catalog as catowner
:
% rman
RMAN> CONNECT CATALOG catowner@catdb;
recovery catalog database Password: password
connected to recovery catalog database
Grant desired privileges to the virtual private catalog owner.
The following example gives user vpc1
access to the metadata for prod1
and prod2
(but not prod3
):
RMAN> GRANT CATALOG FOR DATABASE prod1 TO vpc1; RMAN> GRANT CATALOG FOR DATABASE prod2 TO vpc1;
You can also use a DBID rather than a database name. The virtual private catalog user does not have access to the metadata for any other databases registered in the recovery catalog.
You can also grant the user the ability to register new target databases in the recovery catalog. For example:
RMAN> GRANT REGISTER DATABASE TO vpc1;
This section assumes that the virtual private catalog owner has been given the RECOVERY_CATALOG_OWNER
database role. Also, the base recovery catalog owner used the GRANT
command to give the virtual private catalog owner access to metadata in the base recovery catalog.
To create a virtual private catalog:
Start RMAN and connect to the recovery catalog database as the virtual private catalog owner (not the base recovery catalog owner).
The following example connects to the recovery catalog as vpc1
:
% rman RMAN> CONNECT CATALOG vpc1@catdb;
Create the virtual private catalog.
The following command creates the virtual private catalog:
RMAN> CREATE VIRTUAL CATALOG;
If you intend to use a 10.2 or earlier release of RMAN with this virtual private catalog, then execute the following PL/SQL procedure (where base_catalog_owner is the database user who owns the base recovery catalog):
SQL> EXECUTE base_catalog_owner.DBMS_RCVCAT.CREATE_VIRTUAL_CATALOG;
This section assumes that you have created a virtual private catalog.
Assume that two databases are registered in the base recovery catalog: prod1
and prod2
. As owner of the base recovery catalog, you have granted the vpc1
user access privileges to prod1
. You have also granted this user the right to register databases in his virtual private catalog. Now you want to revoke privileges from vpc1
.
To revoke privileges from a virtual private catalog owner:
Start RMAN and connect to the recovery catalog database as the recovery catalog owner (not the virtual private catalog owner).
The following example connects to the recovery catalog as catowner
:
% rman RMAN> CONNECT CATALOG catowner@catdb;
Revoke specified privileges from the virtual private catalog owner.
The following command revokes access to the metadata for prod1
from virtual private catalog owner vpc1
:
REVOKE CATALOG FOR DATABASE prod1 FROM vpc1;
You can also specify a DBID rather than a database name. The catalog vpc1
retains all other granted catalog privileges.
You can also revoke the privilege to register new target databases in the recovery catalog. For example:
REVOKE REGISTER DATABASE FROM vpc1;
This section assumes that you have created a virtual private catalog and now want to drop it. When you drop a virtual private catalog, you do not remove the base recovery catalog itself, but only drop the synonyms and views that refer to the base recovery catalog.
To drop a virtual private catalog:
Start RMAN and connect to the recovery catalog database as the virtual private catalog owner (not the base recovery catalog owner).
The following example connects to the recovery catalog as user vpc1
:
% rman RMAN> CONNECT CATALOG vpc1@catdb;
Drop the catalog.
If you are using an Oracle Database 11g or later RMAN executable, then drop the virtual private catalog with the DROP CATALOG
command:
RMAN> DROP CATALOG;
If you are using an Oracle Database 10g or earlier RMAN executable, then you cannot use the DROP CATALOG
command. Instead, connect SQL*Plus to the catalog database as the virtual private catalog user, then execute the following PL/SQL procedure (where base_catalog_owner is the database user who owns the base recovery catalog):
SQL> EXECUTE base_catalog_owner.DBMS_RCVCAT.DELETE_VIRTUAL_CATALOG;
Include the recovery catalog database in your backup and recovery strategy. If you do not back up the recovery catalog and a disk failure occurs that destroys the recovery catalog database, then you may lose the metadata in the catalog. Without the recovery catalog contents, recovery of your other databases is likely to be more difficult.
A single recovery catalog can store metadata for multiple target databases. Consequently, loss of the recovery catalog can be disastrous. You should back up the recovery catalog frequently. This section provides general guidelines for developing a strategy for protecting the recovery catalog.
The recovery catalog database is a database like any other, and is also a key part of your backup and recovery strategy. Protect the recovery catalog as you would protect any other part of your database, by backing it up. The backup strategy for your recovery catalog database should be part of your overall backup and recovery strategy.
Back up the recovery catalog with the same frequency that you back up a target database. For example, if you make a weekly whole database backup of a target database, then back up the recovery catalog after the backup of the target database. This backup of the recovery catalog can help you in a disaster recovery scenario. Even if you must restore the recovery catalog database with a control file autobackup, you can use the full record of backups in your restored recovery catalog database to restore the target database.
When backing up the recovery catalog database, you can use RMAN to make the backups. As illustrated in Figure 13-1, start RMAN with the NOCATALOG
option so that the repository for RMAN is the control file in the catalog database.
Figure 13-1 Using the Control File as the Repository for Backups of the Recovery Catalog
Follow these guidelines when developing an RMAN backup strategy for the recovery catalog database:
Run the recovery catalog database in ARCHIVELOG
mode so that you can do point-in-time recovery if needed.
Set the retention policy to a REDUNDANCY
value greater than 1
.
Back up the database to two separate media (for example, disk and tape).
Run BACKUP
DATABASE
PLUS
ARCHIVELOG
at regular intervals, to a media manager if available, or just to disk.
Do not use another recovery catalog as the repository for the backups.
Configure the control file autobackup feature to ON
.
With this strategy, the control file autobackup feature ensures that the recovery catalog database can always be recovered, so long as the control file autobackup is available.
See Also: "Performing Disaster Recovery" for more information for recovery with a control file autobackup |
A recovery catalog is only effective when separated from the data that it is designed to protect. Thus, you should never store a recovery catalog containing the RMAN repository for a database in the same database as the target database. Also, do not store the catalog database on the same disks as the target database.
To illustrate why data separation is advised, assume that you store the catalog for database prod1
in prod1
. If prod1
suffers a total media failure, and if the recovery catalog for prod1
is also stored in prod1
, then if you lose the database you also lose the recovery catalog. At this point the only option is to restore an autobackup of the control file for prod1
and use it to restore and recover the database without the benefit of any information stored in the recovery catalog.
Logical backups of the RMAN recovery catalog created with the Data Pump Export utility can be a useful supplement for physical backups. If a recovery catalog database is damaged, you can use Data Pump Import to quickly reimport the exported recovery catalog data into another database and rebuild the catalog.
Restoring and recovering the recovery catalog database is much like restoring and recovering any other database with RMAN. You can restore the control file and server parameter file for the recovery catalog database from an autobackup, then restore and perform complete recovery on the rest of the database. If you are in a situation where you are using multiple recovery catalogs, then you can also use another recovery catalog to record metadata about backups of this recovery catalog database.
If recovery of the recovery catalog database through the normal Oracle recovery procedures is not possible, then you must re-create the catalog. Examples of this worst-case scenario include:
A recovery catalog database that has never been backed up
A recovery catalog database that has been backed up, but cannot be recovered because the data file backups or archived logs are not available
You have the following options for partially re-creating the contents of the missing recovery catalog:
Use the RESYNC
CATALOG
command to update the recovery catalog with any RMAN repository information from the control file of the target database or a control file copy. Any metadata from control file records that aged out of the control file is lost.
Issue CATALOG START WITH...
commands to recatalog any available backups.
To minimize the likelihood of this worst-case scenario, your backup strategy should at least include backing up the recovery catalog. This technique is described in "Backing Up the Recovery Catalog".
See Also:
|
As explained in "About Stored Scripts", you can store scripts in the recovery catalog. This section explains how to create and manage stored scripts.
You can use a stored script as an alternative to a command file for managing frequently used sequences of RMAN commands. The script is stored in the recovery catalog rather than on the file system.
Stored scripts can be local or global. A local script is associated with the target database to which RMAN is connected when the script is created, and can only be executed when you are connected to that target database. A global stored script can be run against any database registered in the recovery catalog, if the RMAN client is connected to the recovery catalog and a target database.
The commands allowable within the brackets of the CREATE SCRIPT
command are the same commands supported within a RUN
block. Any command that is legal within a RUN
command is permitted in the stored script. The following commands are not legal within stored scripts: RUN
, @
, and @@
.
When specifying a script name, RMAN permits but generally does not require that you use quotes around the name of a stored script. If the name begins with a digit or is an RMAN reserved word, however, then you must put quotes around the name to use it as a stored script name. Consider avoiding stored script names that begin with nonalphabetic characters or that are the same as RMAN reserved words.
Consider using a naming convention to avoid confusion between global and local stored scripts. For the EXECUTE SCRIPT
, DELETE SCRIPT
and PRINT SCRIPT
commands, if the script name passed as an argument is not the name of a script defined for the connected target instance, then RMAN looks for a global script by the same name. For example, if the global script global_backup
is in the recovery catalog, but no local stored script global_backup
is defined for the target database, then the following command deletes the global script:
DELETE SCRIPT global_backup;
To use commands related to stored scripts, even global scripts, you must be connected to both a recovery catalog and a target database instance.
You can use the CREATE SCRIPT
command to create a stored script. If GLOBAL
is specified, then a global script with this name must not exist in the recovery catalog. If GLOBAL
is not specified, then a local script must not exist with the same name for the same target database. You can also use the REPLACE SCRIPT
to create a script or update an existing script.
To create a stored script:
Start RMAN and connect to a target database and recovery catalog (if used).
Run the CREATE
SCRIPT
command.
The following example illustrates creation of a local script:
CREATE SCRIPT full_backup
{
BACKUP DATABASE PLUS ARCHIVELOG;
DELETE OBSOLETE
;
}
For a global script, the syntax is similar:
CREATE GLOBAL SCRIPT global_full_backup
{
BACKUP DATABASE PLUS ARCHIVELOG;
DELETE OBSOLETE
;
}
Optionally, you can provide a COMMENT
with descriptive information:
CREATE GLOBAL SCRIPT global_full_backup
COMMENT 'use only with ARCHIVELOG mode databases'
{
BACKUP DATABASE PLUS ARCHIVELOG;
DELETE OBSOLETE
;
}
You can also create a script by reading its contents from a text file. The file must begin with a left brace ({
) character, contain a series of commands valid within a RUN
block, and end with a right brace (}
) character. Otherwise, a syntax error is signalled, just as if the commands were entered at the keyboard.
CREATE SCRIPT full_backup FROM FILE '/tmp/my_script_file.txt';
Examine the output.
If no errors are displayed, then RMAN successfully created the script and stored in the recovery catalog.