Configure Enterprise Manager (13c) to Use RMAN with Oracle 23ai

Oracle Enterprise Manager (OEM) 13c and RMAN remain the standard tooling for Oracle Database 23ai/23c backup and recovery. This lesson replaces the legacy “Console + Intelligent Agent” screenshots with a modern, task-oriented workflow that you can apply to Container Databases (CDB) and Pluggable Databases (PDBs), on-prem or in cloud VMs. We’ll use one consolidated diagram and practical steps you can run today.

Prerequisites

• OEM 13c (OMS + Agent) deployed and the Agent installed on each database host.
• The target 23ai database (CDB and any PDBs you intend to back up) discovered in OEM and showing Up.
• Preferred Credentials set for the database target (host and database). In OEM: Setup → Security → Preferred Credentials.
• Backup destination available: ASM disk group, file system mount, or SBT (media manager / cloud gateway) if using tape/object storage.

Optional: Create or Reuse a Recovery Catalog

RMAN works without a catalog (it will use the control file), but enterprises often use a dedicated Recovery Catalog to centralize metadata and scripts for multiple databases. Create a small utility database (it can be a PDB) and add a catalog owner:

-- as a DBA in the catalog database (e.g., CATDB/CATPDB)
CREATE USER rman IDENTIFIED BY "Str0ng#Pass"
  QUOTA UNLIMITED ON users
  DEFAULT TABLESPACE users
  TEMPORARY TABLESPACE temp;

GRANT RECOVERY_CATALOG_OWNER TO rman;

Initialize the catalog and register a target:

$ rman CATALOG rman/Str0ng#Pass@catpdb

RMAN> CREATE CATALOG;
RMAN> CONNECT TARGET /  -- or target_user@target_service
RMAN> REGISTER DATABASE;

For CDBs, register the CDB at root and consider separate catalog schemas or tagging for critical PDBs to simplify reporting and recovery workflows.

Baseline RMAN Configuration (Best-Practice Defaults)

Set once per database; these inform both CLI and OEM-generated jobs:

RMAN> CONFIGURE CONTROLFILE AUTOBACKUP ON;
RMAN> CONFIGURE RETENTION POLICY TO RECOVERY WINDOW OF 14 DAYS;
RMAN> CONFIGURE DEVICE TYPE DISK PARALLELISM 2;
RMAN> CONFIGURE COMPRESSION ALGORITHM 'MEDIUM';
-- choose one encryption strategy:
RMAN> CONFIGURE ENCRYPTION FOR DATABASE ON;        -- uses TDE if wallet is open
-- or password-based for specific jobs:
-- RMAN> SET ENCRYPTION ON IDENTIFIED BY 'Secret#1' ONLY;

If writing to ASM, define a backup format. If using an SBT media manager, ensure the library is installed and configured on the host; OEM will call it via RMAN channels.

Connect OEM to RMAN

1. In OEM, open the Database target (root container for CDB, or the PDB target for per-PDB jobs).
2. Navigate to Availability → Backup & Recovery, then click Schedule Backup.
3. If you maintain a recovery catalog, go to Settings → Recovery Settings and provide the catalog service and credentials; OEM will test the connection and store them securely.

Schedule a Backup Job from OEM

1. Backup Type: Full or Incremental. For CDBs, choose Whole Database or Specific PDBs.
2. Channels & Parallelism: Accept RMAN CONFIGURE defaults or override per job (e.g., two DISK channels).
3. Destination: ASM, file system path, or SBT. Provide format strings if needed, such as:

   +FRA/<DB_UNIQUE_NAME>/backupset/%T/%d_%U.bkp
       

4. Compression & Encryption: Use database TDE if wallets are configured; otherwise select password-based encryption for the job.
5. Retention: Inherit from CONFIGURE RETENTION or specify a window for this job.
6. Schedule: One-time or repeating (e.g., nightly at 23:00). Set blackout windows if you use OEM target blackouts.
7. Review & Submit: OEM renders the RMAN script and saves it with the job definition for auditability.

What the RMAN Script Looks Like

OEM generates a script similar to this (you can save it for CLI reuse):

RUN {
  ALLOCATE CHANNEL c1 DEVICE TYPE DISK;
  ALLOCATE CHANNEL c2 DEVICE TYPE DISK;
  BACKUP AS COMPRESSED BACKUPSET DATABASE PLUS ARCHIVELOG
    TAG 'OEM_NIGHTLY_FULL';
  DELETE NOPROMPT OBSOLETE;  -- obeys retention policy
  RELEASE CHANNEL c1;
  RELEASE CHANNEL c2;
}

Monitoring, Reporting, and Alerts

• Job Activity: Enterprise → Job Activity shows status, duration, and output. Drill into a job to view the raw RMAN log.
• Backup Reports: Availability → Backup Reports aggregates success/failure, sizes, and recoverability by target and time.
• Alerts: OEM raises incidents if a job fails, FRA is low, or if the retention policy cannot be satisfied. Tie these to notifications or ticketing.

Restore & Recovery with OEM

From the target database page choose Availability → Restore/Recover. OEM guides you through point-in-time or SCN-based recovery, PDB-level recovery, and control file autobackup restore. For test restores, use Duplicate Database workflows to create a clone into a sandbox server or a new PDB.

Security & Governance Notes

• Prefer TDE (transparent data encryption) so backups are encrypted without embedding passwords into job definitions.
• Use Named Credentials and Privilege Delegation in OEM to avoid storing OS passwords in cleartext.
• Harden the catalog database: protect the RECOVERY_CATALOG_OWNER account and periodically back up the catalog itself.

Legacy vs. Modern Summary

The early-2000s OEM “Configuration Assistant” and step-by-step screens have been replaced by OEM 13c’s target-centric pages and job system. Instead of following 13 separate UI wizards, configure RMAN once, store credentials, and schedule policy-driven jobs that OEM executes through the Agent. The result is a simpler, auditable, and repeatable protection plan for Oracle 23ai databases.

Quick Troubleshooting

• Agent up but jobs fail: verify OS privileges of the Agent user to access backup directories and SBT libraries.
• Catalog connection errors: test tnsping to the catalog, confirm network ACLs, and re-enter Named Credentials.
• Backups too large: enable RMAN compression; verify that archived log deletion policy matches retention strategy.

Next lesson: Launching RMAN jobs from OEM for nightly full + daily incremental strategy.