What this walkthrough gets you
A working Veeam Data Platform deployment that protects three distinct estates on Oracle Cloud Infrastructure: native OCI Compute instances (agent-based), Oracle Cloud VMware Solution guest VMs (agentless, image-level), and Oracle Database (RMAN-driven). It ends with a tiered repository built on OCI's own storage services, so nothing here depends on a foreign cloud's object store.
Stack & versions used in this write-up
Veeam Backup & Replication 12.3Veeam Plug-in for Oracle RMAN 6.xVeeam Agent for Linux/Windows 6.xOCI Compute · VM.Standard.E5OCI Object Storage (S3-compatible endpoint)OCI File Storage (NFS)Oracle DB 19c / 23aiTerraform 1.7 · Ansible 2.16
Why OCI needs a different playbook
Veeam's agentless magic on VMware and Hyper-V comes from talking directly to the hypervisor's snapshot API. OCI Compute doesn't expose an equivalent for native instances, so the same "point Veeam at the cluster and walk away" workflow doesn't exist there. What does exist, and what this guide is built around, is a three-part pattern that's been proven in production:
- A Veeam Agent installed inside each OCI Compute VM, managed centrally by the backup server as if it were a physical box.
- The Veeam Plug-in for Oracle RMAN, which hands the DBA's own
rman commands a fast, deduplicated, encrypted landing zone. - Genuinely agentless, image-level protection wherever Oracle Cloud VMware Solution (OCVS) is in the picture, since OCVS is a real vSphere SDDC underneath.
Before you commit to a designCmdlet names, supported storage tiers, and immutability behavior have shifted across recent Veeam releases and OCI Object Storage updates. Cross-check the current Veeam Ready listing and the Veeam community forums against your target versions before finalizing an architecture.
SECTION 02 Reference architecture
One Veeam Backup & Replication server sits in an isolated management network. It reaches out to three protected estates and writes into a two-tier repository — fast storage for recent restore points, OCI Object Storage underneath for everything older.
Sizing & prerequisites
| Component | Floor | Comfortable | Notes |
|---|
| Veeam Backup & Replication | 12.1 | 12.3.x | Runs on a dedicated OCI Windows Compute VM |
| Veeam Plug-in for Oracle RMAN | 4.x | 6.x | Installed alongside the Oracle client on the DB host |
| Veeam Agent (Linux/Windows) | 5.x | 6.x | Application-aware mode for Oracle detection |
| Oracle Database | 19c (19.3) | 19c latest RU / 23ai | ARCHIVELOG mode is mandatory |
| OCI Object Storage | Standard tier | Standard + Infrequent Access | Accessed via its S3-compatible endpoint |
| OCI File Storage | — | Mount target in a private subnet | Serves as the performance-tier repository |
| Terraform / OCI provider | 1.5 / 5.x | 1.7+ / 6.x | For a repeatable build |
Identity & access baselineCarve out a dedicated backup compartment, create a dynamic group that matches the Veeam server's instance OCID, and scope its policy to object-family, volume-family, and file-family inside that compartment only — never grant it rights in the production compartment.
SECTION 04 Standing up the Veeam server
1
Provision the management VMAn 8-OCPU / 64 GB VM.Standard.E5.Flex Windows Server 2022 instance, private subnet, no public IP unless a bastion requires one.
bash — provision the Veeam server and its catalog volume
# Launch the Veeam Backup & Replication server
oci compute instance launch \
--compartment-id ocid1.compartment.oc1..aaaaaaaabackupcmp \
--availability-domain "AD-1" \
--shape "VM.Standard.E5.Flex" \
--shape-config '{"ocpus":8,"memoryInGBs":64}' \
--display-name "veeam-vbr-mgmt-01" \
--image-id ocid1.image.oc1..aaaaaaaawin2022std \
--subnet-id ocid1.subnet.oc1..aaaaaaaabackupsub \
--assign-public-ip false \
--hostname-label veeam-vbr-mgmt-01
# Attach a volume to hold the Veeam configuration/catalog database
oci bv volume create \
--compartment-id ocid1.compartment.oc1..aaaaaaaabackupcmp \
--availability-domain "AD-1" \
--size-in-gbs 500 \
--display-name "veeam-catalog-vol"PS C:\Users\administrator> Get-Service VeeamBackupSvc, VeeamCatalogSvc, VeeamCloudSvc Status Name DisplayName ------ ---- ----------- Running VeeamBackupSvc Veeam Backup Service Running VeeamCatalogSvc Veeam Guest Catalog Service Running VeeamCloudSvc Veeam Cloud Connect Service
Fig 2. Core services up and running on the OCI-hosted Veeam server.
2
Scope its OCI identity narrowlyA dynamic group tied to the server's own OCID, and a policy that only reaches into the backup compartment.
hcl — dynamic group + least-privilege policy
resource "oci_identity_dynamic_group" "veeam_dg" {
compartment_id = var.tenancy_ocid
name = "veeam-vbr-dynamic-group"
description = "Matches the Veeam server instance so it can reach backup storage"
matching_rule = "ANY {instance.id = '${oci_core_instance.veeam_vbr.id}'}"
}
resource "oci_identity_policy" "veeam_policy" {
compartment_id = var.tenancy_ocid
name = "veeam-backup-policy"
description = "Scopes the Veeam server to backup-compartment storage only"
statements = [
"Allow dynamic-group veeam-vbr-dynamic-group to manage object-family in compartment backup-compartment",
"Allow dynamic-group veeam-vbr-dynamic-group to use volume-family in compartment backup-compartment",
"Allow dynamic-group veeam-vbr-dynamic-group to use file-family in compartment backup-compartment",
"Allow dynamic-group veeam-vbr-dynamic-group to read instances in compartment production-compartment",
]
}Native Compute: agent-based VM backup
Every production VM runs the Veeam Agent, and the backup server treats the fleet as a Protection Group of managed computers rather than a hypervisor's inventory.
1
Install and register the agent on an Oracle Linux host
bash — install & register Veeam Agent for Linux
# Add the Veeam repository and install the agent package
curl -1sLf 'https://repo.veeam.com/veeam/veeam-release.repo' | sudo tee /etc/yum.repos.d/veeam.repo
sudo dnf install -y veeam-release veeam
# Point the agent at the central Veeam server (managed mode)
sudo veeamconfig server addinfo \
--name vbr01.backup.internal.oci \
--port 10005 \
--certfile /etc/veeam/vbr01.pem
sudo veeamconfig server list
[opc@ebs-app01 ~]$ sudo veeamconfig server list Server Port Status ------------------------ ---- -------- vbr01.backup.internal.oci 10005 Connected
Fig 3. The agent has phoned home and is now a managed member of the backup infrastructure.
2
Create the protection group and jobConsole path: Inventory → Physical & Cloud Infrastructure → Add → Individual Computers, then Home → Backup Job → Linux Computer.
powershell — build the job from the console host
# Register the OCI instance as a protected computer
Import-Module Veeam.Backup.PowerShell
$creds = Get-VBRCredentials -Name "opc-oci-key"
Add-VBRComputer -Name "ebs-app01.oci.internal" -Type Linux -Credentials $creds
# Point a nightly job at the tiered OCI repository built in Chapter 08
Add-VBRComputerBackupJob `
-Name "OCI-AppTier-Backup" `
-BackupRepository (Get-VBRBackupRepository -Name "OCI-Tiered-Repository") `
-Computer (Get-VBRComputer -Name "ebs-app01.oci.internal") `
-BackupType EntireComputer `
-ScheduleType Daily `
-ScheduleTime "22:00"
Job liveOCI-AppTier-Backup now runs nightly at 22:00, capturing the whole VM with application-aware processing for any Oracle Database it finds, landing in OCI-Tiered-Repository.
SECTION 06 OCVS: agentless image-level backup
Where Oracle Cloud VMware Solution is part of the estate, Veeam behaves exactly as it would against any on-premises vSphere cluster — no agent, full Changed Block Tracking, image-level restore points.
powershell — register OCVS vCenter, create the image-level job
# Add the OCVS vCenter as a managed virtualization server
Add-VBRServer -Type VC -Name "ocvs-vcenter.oci.internal" `
-Credentials (Get-VBRCredentials -Name "ocvs-svc-account")
# Image-level job across the OCVS cluster's guest VMs
Add-VBRViBackupJob `
-Name "OCVS-GuestVM-Backup" `
-Entity (Find-VBRViEntity -Name "OCVS-Cluster-01") `
-BackupRepository (Get-VBRBackupRepository -Name "OCI-Tiered-Repository") `
-CompressionLevel Optimal `
-EnableCBT $true
ocvs-vcenter.oci.internal → Backup Infrastructure → Managed Servers
| Server | Type | Status |
|---|
| ocvs-vcenter.oci.internal | VMware vCenter | Connected |
| vbr01.backup.internal.oci | Backup Server | This Server |
Fig 4. OCVS's vCenter registered as a managed server — the same trust relationship you'd build on-premises.
SECTION 07 Oracle Database via the RMAN plug-in
The DBA keeps driving rman. The plug-in supplies an SBT_TAPE library that streams every backup piece into a Veeam-managed repository, picking up dedup, compression, encryption, and retention along the way.
1
Install the plug-in on the database host
bash — install & test the RMAN plug-in
sudo dnf install -y veeam-plugin-oracle-rman-6.0.rpm
sudo /opt/veeam/oracleplugin/rmanplugin \
--set-server vbr01.backup.internal.oci --port 10005
sudo /opt/veeam/oracleplugin/rmanplugin --test-connection
oracle@ebs-db01:~$ /opt/veeam/oracleplugin/rmanplugin --test-connection Connecting to vbr01.backup.internal.oci:10005 ... OK Repository: OCI-Tiered-Repository ... Reachable License: Enterprise Plus ... Valid
Fig 6. Connectivity and licensing both check out before the first real backup runs.
2
Configure the channel and run a full backup
sql — RMAN channel configuration & backup
rman target /
CONFIGURE DEFAULT DEVICE TYPE TO 'SBT_TAPE';
CONFIGURE CHANNEL DEVICE TYPE 'SBT_TAPE'
PARMS="SBT_LIBRARY=/opt/veeam/oracleplugin/libveeamsbt.so,
ENV=(VEEAM_SERVER=vbr01.backup.internal.oci,
VEEAM_REPOSITORY=OCI-Tiered-Repository,
VEEAM_JOB_NAME=EBSPROD-RMAN-Nightly)";
CONFIGURE CONTROLFILE AUTOBACKUP ON;
CONFIGURE RETENTION POLICY TO RECOVERY WINDOW OF 14 DAYS;
RUN {
ALLOCATE CHANNEL c1 DEVICE TYPE 'SBT_TAPE';
ALLOCATE CHANNEL c2 DEVICE TYPE 'SBT_TAPE';
ALLOCATE CHANNEL c3 DEVICE TYPE 'SBT_TAPE';
ALLOCATE CHANNEL c4 DEVICE TYPE 'SBT_TAPE';
BACKUP AS COMPRESSED BACKUPSET
DATABASE
PLUS ARCHIVELOG
TAG 'EBSPROD_NIGHTLY'
FORMAT 'db_%d_%U';
BACKUP CURRENT CONTROLFILE;
RELEASE CHANNEL c1;
RELEASE CHANNEL c2;
RELEASE CHANNEL c3;
RELEASE CHANNEL c4;
}
LIST BACKUP SUMMARY;Starting backup at 07-JUL-2026 22:15:03 allocated channel: c1 channel c1: SBT_TAPE device type... connecting to repository OCI-Tiered-Repository channel c1: starting compressed full datafile backup set channel c1: finished piece 1 at 07-JUL-2026 22:47:19 ... Finished backup at 07-JUL-2026 22:51:44
Fig 7. Four parallel channels streaming straight into the OCI-backed repository.
3
Wrap it in a scheduled job
bash — /u01/scripts/rman_veeam_backup.sh
#!/bin/bash
# Nightly full + archivelog backup via the Veeam RMAN plug-in
export ORACLE_SID=EBSPROD
export ORACLE_HOME=/u01/app/oracle/product/19.0.0/dbhome_1
export PATH=$ORACLE_HOME/bin:$PATH
LOGFILE=/u01/scripts/logs/rman_$(date +%Y%m%d_%H%M%S).log
rman target / log=$LOGFILE <<EOF
RUN {
ALLOCATE CHANNEL c1 DEVICE TYPE 'SBT_TAPE';
ALLOCATE CHANNEL c2 DEVICE TYPE 'SBT_TAPE';
BACKUP AS COMPRESSED BACKUPSET DATABASE PLUS ARCHIVELOG
TAG 'NIGHTLY_$(date +%Y%m%d)' FORMAT 'db_%d_%U';
BACKUP CURRENT CONTROLFILE;
DELETE NOPROMPT OBSOLETE;
RELEASE CHANNEL c1;
RELEASE CHANNEL c2;
}
EOF
grep -qi "ORA-\|RMAN-" "$LOGFILE" && \
mail -s "RMAN Backup FAILED on $(hostname)" dba-team@example.com < "$LOGFILE"crontab — nightly trigger
0 22 * * * /u01/scripts/rman_veeam_backup.sh >> /u01/scripts/logs/cron.log 2>&1
Building the tiered repository (SOBR)
The recommended shape is a Scale-Out Backup Repository: fast OCI File Storage for the most recent restore points, tiering out to OCI Object Storage for everything older.
A naming noteObject Storage's wire protocol happens to be S3-compatible, which is why some Veeam builds still expose cmdlets carrying an "AmazonS3Compatible" prefix left over from that protocol's origin. The walkthrough below uses Oracle-facing names throughout (Add-VBRObjectStorageRepository and friends); if your installed version hasn't renamed them yet, run Get-Command *S3* to find the local equivalents.
1
Create the performance-tier file system
bash — OCI File Storage + mount target
oci fs file-system create \
--compartment-id ocid1.compartment.oc1..aaaaaaaabackupcmp \
--availability-domain "AD-1" \
--display-name "veeam-perf-fs"
oci fs mount-target create \
--compartment-id ocid1.compartment.oc1..aaaaaaaabackupcmp \
--availability-domain "AD-1" \
--subnet-id ocid1.subnet.oc1..aaaaaaaabackupsub \
--display-name "veeam-perf-mt"
2
Create the capacity-tier bucket and its access key
bash — Object Storage bucket + secret key
oci os bucket create \
--compartment-id ocid1.compartment.oc1..aaaaaaaabackupcmp \
--name veeam-oci-capacity-tier \
--storage-tier Standard
oci iam customer-secret-key create \
--user-id ocid1.user.oc1..aaaaaaaaveeamsvcuser \
--display-name "veeam-oci-object-key"
3
Register it all in Veeam
powershell — object storage connection, extents, SOBR
# Register OCI Object Storage as the capacity-tier connection
Add-VBRObjectStorageConnection `
-Name "OCI-Object-Storage" `
-Type OCICompatible `
-ServicePoint "https://axhbwqrfr7pd.compat.objectstorage.me-jeddah-1.oraclecloud.com" `
-Credentials (Get-VBRObjectStorageAccessKey -AccessKey "OCI_VEEAM_KEY" `
-SecretKey (ConvertTo-SecureString "***" -AsPlainText -Force))
$ociBucket = Get-VBRObjectStorageBucket `
-Connection (Get-VBRObjectStorageConnection -Name "OCI-Object-Storage") `
-Name "veeam-oci-capacity-tier"
Add-VBRObjectStorageRepository `
-Name "OCI-Capacity-Tier" `
-ObjectStorageFolder $ociBucket `
-Bucket $ociBucket
# Performance tier on the File Storage NFS mount
Add-VBRNFSBackupRepository `
-Name "OCI-Performance-Tier" `
-Server "veeam-perf-mt.backup.internal.oci" `
-Path "/veeam-perf-fs"
# Combine both into the Scale-Out Backup Repository
Add-VBRScaleOutBackupRepository `
-Name "OCI-Tiered-Repository" `
-Extent (Get-VBRBackupRepository -Name "OCI-Performance-Tier") `
-CapacityExtent (Get-VBRBackupRepository -Name "OCI-Capacity-Tier") `
-CapacityTierCopyPolicy `
-OperationalRestorePeriodDays 14Repository liveOCI-Tiered-Repository keeps 14 days of restore points on File Storage and copies every one of them to Object Storage for cheaper, longer retention.
SECTION 09 Repeatable deployment: Terraform & Ansible
hcl — core networking, compute, and the capacity bucket
terraform {
required_providers {
oci = { source = "oracle/oci", version = ">= 6.0.0" }
}
}
resource "oci_core_vcn" "backup_vcn" {
compartment_id = var.backup_compartment_id
cidr_blocks = ["10.90.0.0/24"]
display_name = "vcn-veeam-backup"
dns_label = "veeambkp"
}
resource "oci_core_subnet" "backup_subnet" {
compartment_id = var.backup_compartment_id
vcn_id = oci_core_vcn.backup_vcn.id
cidr_block = "10.90.0.0/25"
display_name = "subnet-veeam-mgmt"
prohibit_public_ip_on_vnic = true
}
resource "oci_core_instance" "veeam_vbr" {
compartment_id = var.backup_compartment_id
availability_domain = var.availability_domain
shape = "VM.Standard.E5.Flex"
shape_config {
ocpus = 8
memory_in_gbs = 64
}
display_name = "veeam-vbr-mgmt-01"
create_vnic_details {
subnet_id = oci_core_subnet.backup_subnet.id
assign_public_ip = false
}
source_details {
source_type = "image"
source_id = var.windows_2022_image_id
}
}
resource "oci_objectstorage_bucket" "capacity_tier" {
compartment_id = var.backup_compartment_id
namespace = var.object_storage_namespace
name = "veeam-oci-capacity-tier"
storage_tier = "Standard"
versioning = "Enabled"
}yaml — Ansible: bootstrap the fleet
---
- name: Configure Veeam Agent and Oracle RMAN plugin across the OCI fleet
hosts: oci_oracle_hosts
become: true
vars:
veeam_repo: "https://repo.veeam.com/veeam/veeam-release.repo"
vbr_server: "vbr01.backup.internal.oci"
tasks:
- name: Add Veeam yum repository
get_url:
url: "{{ veeam_repo }}"
dest: /etc/yum.repos.d/veeam.repo
- name: Install Veeam Agent for Linux
dnf:
name: veeam
state: present
- name: Register agent to the central Veeam server
command: >
veeamconfig server addinfo
--name {{ vbr_server }} --port 10005
args:
creates: /etc/veeam/registered.flag
- name: Install the Oracle RMAN plug-in on database hosts
dnf:
name: veeam-plugin-oracle-rman
state: present
when: "'oracle_db' in group_names"
- name: Deploy the nightly RMAN wrapper script
copy:
src: files/rman_veeam_backup.sh
dest: /u01/scripts/rman_veeam_backup.sh
mode: '0750'
owner: oracle
group: oinstall
when: "'oracle_db' in group_names"
- name: Schedule the nightly RMAN backup
cron:
name: "Veeam RMAN nightly backup"
user: oracle
hour: "22"
minute: "0"
job: "/u01/scripts/rman_veeam_backup.sh >> /u01/scripts/logs/cron.log 2>&1"
when: "'oracle_db' in group_names"Immutability & the 3-2-1-1-0 rule
Known gap, worth planning aroundOCI Object Storage's bucket-level retention rules aren't yet recognized by Veeam as true S3 Object Lock, so immutability can't be fully enforced on the capacity tier alone today. Compensate with the layers below.
| Layer | How it's satisfied here |
|---|
| 3 copies of data | Production + Performance Tier + Capacity Tier |
| 2 different media | File Storage (performance) vs. Object Storage (capacity) |
| 1 offsite copy | Cross-region Object Storage replication |
| 1 immutable / air-gapped copy | Veeam Data Cloud Vault, or a hardened Linux repository in immutable mode |
| 0 errors | Scheduled SureBackup jobs validating boot and application health |
json — deny-all guard rail on the backup compartment
{
"statements": [
"Allow group Production-Admins to manage all-resources in compartment production-compartment",
"Deny group Production-Admins to manage object-family in compartment backup-compartment where request.permission != 'OBJECT_INSPECT'",
"Allow group Security-Officers to manage object-family in compartment backup-compartment",
"Allow dynamic-group veeam-vbr-dynamic-group to manage object-family in compartment backup-compartment"
]
}Troubleshooting field notes
| Symptom | Likely cause | Fix |
|---|
| RMAN-06059: expected archived log not found | RMAN's own retention purged a log before the Veeam catalog caught up | Widen the recovery window; run CROSSCHECK ARCHIVELOG ALL; before any delete |
| Agent shows Disconnected in the console | Security list/NSG blocking the management or data ports | Open TCP 2500–3300 (data) and 10005 (agent management) between the VM and the server |
| ORA-19506: SBT interface failure | Wrong libveeamsbt.so path, or an unlicensed plug-in | Re-run rmanplugin --test-connection; confirm Enterprise Plus licensing |
| Uploads to Object Storage crawl | Single-threaded upload, small multipart chunk size | Raise the repository's upload thread count and part size |
| Capacity tier never receives copies | Copy policy disabled, or offload window mismatched | Confirm -CapacityTierCopyPolicy is set and Copy (not Move) mode is intended |
| Access denied writing to the bucket | IAM policy scoped to the wrong compartment | Check the dynamic group's matching rule against the bucket's compartment OCID |
SECTION 12 Health-check commands
sql — database-side checks
SELECT log_mode FROM v$database;
SELECT session_key, input_type, status, start_time, end_time
FROM v$rman_backup_job_details
ORDER BY start_time DESC
FETCH FIRST 10 ROWS ONLY;
RMAN> REPORT OBSOLETE;
RMAN> CROSSCHECK BACKUP;
powershell — Veeam-side checks
Get-VBRBackupSession | Sort-Object CreationTime -Descending |
Select-Object -First 10 Name, Result, EndTime
Get-VBRBackupRepository | Select-Object Name, `
@{n='FreeGB';e={[math]::Round($_.GetContainer().CachedFreeSpace/1GB,1)}}bash — connectivity spot-checks
veeamconfig server list
curl -I https://<namespace>.compat.objectstorage.<region>.oraclecloud.com
ldd /opt/veeam/oracleplugin/libveeamsbt.so
Wrap-up & where to go next
What's protected nowIAM scoping → the Veeam server itself → agent-based Compute VMs → agentless OCVS guest VMs → RMAN-driven Oracle Database backups → a tiered repository spanning File Storage and Object Storage → Terraform/Ansible to rebuild any of it on demand.
- Turn on SureBackup so every restore point — VM image or database — gets booted and validated automatically.
- Layer in Veeam Data Cloud Vault or Cloud Connect as the genuinely immutable, air-gapped fourth copy until Object Storage reaches full lock parity.
- Script the DR runbook so the Terraform module can redeploy compute in a second region straight from the replicated bucket.
- Bring in Veeam ONE for fleet-wide monitoring and alerting across the OCI estate.
- Set Object Storage lifecycle rules to auto-tier restore points from Standard to Infrequent Access once they age past the operational window.
Syed Zaheer
Service Delivery Director · Techvisions · Cloud, AI & Managed Infrastructure
Syed Zaheer is Service Delivery Director at Techvisions, author, speaker, and technology enthusiast with deep expertise in the Oracle landscape covering databases, middleware, Applications, AI and cloud infrastructure. He actively contributes to the Oracle community through technical articles, conference presentations, and knowledge-sharing initiatives, helping organizations modernize and optimize their enterprise technology platforms.
Comments