Backing up Oracle databases with Veeam: RMAN, ransomware resilience and restore testing

What an Oracle backup must deliver

Before choosing a tool, we agree two numbers with the system owner. RPO is how much data we can afford to lose (for example 15 minutes). RTO is how long the system may be down (for example 4 hours). Everything else follows from these:

A database in NOARCHIVELOG mode cannot be backed up without downtime: Veeam shuts such a database down before an image backup. For production systems, ARCHIVELOG mode is a must.

Option 1: application-aware machine backup

Veeam backs up the whole virtual machine or physical server (through Veeam Agent), and application-aware processing prepares the database so that the backup is consistent. A separate job copies archived logs every few minutes and can delete them from the server after a successful backup. By default logs are copied every 15 minutes, and the longest interval is 480 minutes. The account Veeam uses needs SYSDBA privileges.

The advantages: one backup protects the whole server including the operating system, and a database restore does not need a database administrator. Limitations according to Veeam's documentation:

• No Oracle RAC support. Clusters need the RMAN plug-in.
• ASM is supported only with ASMLib. In Veeam Agent for Linux, version 13.1 does not back up databases on ASM volumes.
• Oracle Express and Oracle Database Free on Windows only. Several Oracle versions on one Windows server are not supported.
• With Data Guard, every server must be in the job.
• In version 13.1, log backups cannot go to a cloud repository or to tape.

Supported systems are Windows Server 2016 to 2025, Red Hat Enterprise Linux 8 and 9, Oracle Linux 7 to 9 and SUSE Linux Enterprise. Supported database versions are 11gR2 to 26ai, except 23ai.

Option 2: the Veeam Plug-in for Oracle RMAN

The plug-in registers with RMAN as an SBT_TAPE device. RMAN itself takes the backups, following the DBA team's scripts and schedule, while Veeam provides repositories, retention, immutability and off-site copies. Everything RMAN can do with an SBT_TAPE device also works with the plug-in: ASM, container databases (CDB), incremental backups.

The plug-in supports RAC, Exadata and Oracle Database Appliance, and besides Windows and Linux also AIX and Solaris. It is configured with a wizard-driven tool that saves its settings and a copy of the existing RMAN configuration:

# Linux: configure the plug-in (Veeam server connection, repositories, channels)
OracleRMANConfigTool --wizard

The wizard makes the plug-in channel RMAN's default device. This is how it looks in Veeam's documentation (the identifier at the start of the file name is the repository ID):

CONFIGURE CHANNEL DEVICE TYPE SBT_TAPE PARMS 'SBT_LIBRARY=/opt/veeam/VeeamPluginforOracleRMAN/libOracleRMANPlugin.so' FORMAT '3ff6897d-5107-408e-a176-68bf8c8ff3a4/RMAN_%I_%d_%T_%U.vab';
CONFIGURE CONTROLFILE AUTOBACKUP FORMAT FOR DEVICE TYPE SBT_TAPE TO '%F_RMAN_AUTOBACKUP.vab';

RUN {
BACKUP DATABASE PLUS ARCHIVELOG;
}
EXIT;

The plug-in can write to up to 4 repositories in parallel, with 1 to 254 channels per repository (one channel on Oracle Standard Edition). In managed mode, backup policies are created from the Veeam console; this mode works on Windows and Linux x86_64 and does not support Data Guard. Version 13.1 added GFS retention for RMAN policies, plug-in backups to tape and Oracle 26ai support.

Which option to choose

In practice: single databases on Linux or Windows virtual machines we protect with image backup, because it is simplest and covers the whole server. RAC, Exadata, Unix systems and environments where DBAs have their own RMAN procedures we protect with the plug-in. Both methods can be combined on one server, which then consumes a single licence.

Restoring: Veeam Explorer for Oracle and RMAN

Veeam Explorer for Oracle restores databases from image backups and plug-in backups. It can:

• restore the latest state or the state at a chosen moment (a time slider based on the logs),
• restore to a specific transaction (this needs a staging Oracle server),
• restore to another server, for example a test one,
• start the database instantly from the backup and move it to the target server in the background,
• export the database as an RMAN backup or as database files.

Limitations: Explorer does not restore an individual PDB (use the RMAN plug-in for that) or an individual table. To recover a table, restore the database to a test server and export the data, or use the RMAN RECOVER TABLE command. Point-in-time restore does not work from backup copies or from cloud repositories. From plug-in backups, Explorer only restores and exports the restore script.

On the RMAN side, a restore to the original server looks standard:

RUN {
SHUTDOWN IMMEDIATE;
STARTUP MOUNT;
RESTORE DATABASE;
RECOVER DATABASE;
}
EXIT;

Ransomware-resilient backups

A ransomware attack usually starts by deleting or encrypting the backups. Veeam describes the 3-2-1-1-0 rule: three copies of data, on two types of media, one off-site, one immutable or air-gapped, and zero errors on restore, confirmed by testing.

• A hardened Linux repository: backup files are locked for 7 to 9999 days and cannot be deleted or changed, even from a Veeam administrator account. A note for Oracle: log backups do not get an automatic immutability extension, so the period must cover the whole active chain.
• Object storage with Object Lock (S3, S3-compatible, Azure Blob and others): versioning and Object Lock must be enabled; the RMAN plug-in uses compliance mode.
• Version 13.1 added, among other things, second-person approval for shortening immutability, immutable Veeam configuration backups and read-only attachment of an immutable object repository from a second Veeam server, for example for restore testing.

We also recommend separate Veeam accounts with multi-factor authentication, a backup server outside the Active Directory domain and a backup network in its own zone that users' computers cannot reach. How we divide networks into zones is covered in our guide on network segmentation.

Restore testing

A backup nobody has ever restored from is just an assumption. SureBackup in Veeam starts machines from backup in an isolated virtual lab, together with the machines they depend on (domain controller, DNS), and checks them with tests. The predefined tests, however, cover DNS, domain controllers and Microsoft SQL Server among others, but not Oracle. For Oracle we prepare a custom verification script that, once the machine is running in the lab, connects to the database and checks that it works and holds current data.

Backups taken with the RMAN plug-in we check with Oracle's own tools. VALIDATE commands do everything a real restore does, except write the files:

RESTORE DATABASE VALIDATE;
RESTORE ARCHIVELOG ALL VALIDATE;
BACKUP VALIDATE CHECK LOGICAL DATABASE ARCHIVELOG ALL;

Once a quarter we do a full restore of the most important database to a test server and time it. Only that measurement tells you whether the promised RTO is realistic.

Step-by-step rollout

1. InventoryDatabases, versions, ARCHIVELOG mode, RAC, ASM, Data Guard, sizes and log growth. Plus RPO and RTO agreed with the system owners.
2. Choice of methodImage backup or the RMAN plug-in for each database, a schedule for full and log backups, retention.
3. RepositoriesA primary repository, a hardened Linux repository or object storage with immutability, and an off-site copy.
4. Permissions and networkLeast-privilege accounts (SYSDBA or SYSBACKUP), multi-factor authentication for the Veeam console, the backup network in its own zone.
5. First restoreBefore sign-off: a restore of the database to a test server at a chosen moment, with timing.
6. Recurring testsSureBackup with a custom Oracle script, VALIDATE commands and a quarterly full restore with a report.

• Production databases in ARCHIVELOG mode.
• Log backups every 15 minutes or more often, in line with the RPO.
• At least one immutable copy and one off-site copy.
• An immutability period that covers the whole backup chain, including logs.
• Every RAC node licensed, with the plug-in installed on every node.
• A documented restore procedure and the result of the last test, including its duration.
• An upgrade plan for 21c databases, whose support ends in July 2027.

Frequently asked questions

Sources

• Veeam: Veeam Plug-in for Oracle RMAN
• Veeam: supported applications and Oracle versions
• Veeam: Oracle settings in a backup job
• Veeam: planning the environment for the RMAN plug-in
• Veeam Explorer for Oracle
• Veeam: immutability on a hardened repository
• Veeam: licensing for the RMAN plug-in
• Veeam KB2680: Veeam Backup & Replication build numbers
• Oracle: validating database files and backups
• Oracle Lifetime Support Policy: technology products

As of 6 November 2026. Support and licensing details depend on the Veeam version; check the compatibility matrix for your version before deployment.