Whitepaper — PodHeitor OracleDB - PodHeitor — Backup, Replicação e Recuperação de Desastres

Oracle Database backup integrated with RMAN. Hot backup, archive log streaming, SCN-precise PITR, Data Guard primary/standby support, RAC and multi-tenant PDB.

Native RMAN integration — catalog control, automatic BLOCKRECOVER validation.
Continuous archive log streaming — near-zero RPO.
SCN-precise PITR — restore to an exact Oracle transaction number.
Data Guard-aware — back up from standby, zero overhead on primary.
RAC and multi-tenant (PDB) — back up individual PDBs, restore to a different CDB.

Production-ready in 30 days, at least 50% cheaper. Free trial, signed RPMs and DEBs, direct support from Heitor Faria. Replace your Veeam, Commvault or Bacula Enterprise license without breaking the nightly window.

Request a free 30-day trial →

COMMERCIAL OFFER — READ THIS FIRST

Switching from Bacula Enterprise, Veeam, Commvault, or NetBackup? Bring your renewal quote or active contract proposal and we guarantee a minimum 50% discount — with significantly more features out of the box.

Executive Summary
The Problem
Solution Overview
Architecture
Feature Comparison Table
Backup Options Reference
Restore Options Reference
FileSet Configuration Examples
Restore Job Examples
Installation and Sizing Guide
Compatibility Matrix
Performance Report
Security and Compliance
Support and Commercial Terms
Appendix A — Architecture Decision Records
Appendix B — Glossary

1. Executive Summary

What Is It?

The PodHeitor OracleDB Backup and Replication Plugin for PodHeitor Backup is a production-grade, commercially-polished Bacula File Daemon plugin that delivers comprehensive Oracle Database protection — from hot backups via RMAN SBT v2 all the way to continuous data protection (CDP) and native disaster-recovery replication — at a fraction of the cost of proprietary alternatives.

Written entirely in Rust (built in Rust with native memory safety and zero runtime dependencies), the plugin ships as a single RPM or DEB package (under 700 KB installed) and requires no Oracle-specific third-party libraries, no proprietary SBT implementations, and no shell-script wrappers outside of Bacula.

Business Value in Three Points

50%+ Cost Reduction. Oracle database backup is one of the most expensive line items in any enterprise IT budget. Bacula Enterprise charges per-client or per-agent licensing fees that compound with every Oracle instance you protect. Veeam, Commvault, and NetBackup add agent licences, module add-ons, and annual maintenance on top. PodHeitor delivers every capability those platforms offer — and several they do not — at a per-organisation flat fee (no per-socket or per-TB metering entirely.

More Features, Not Fewer. This is not a stripped-down open-source alternative. The plugin exceeds Bacula Enterprise 18.2.3 on continuous data protection (CDP daemon mode), native DR replication for Standard Edition 2 (archivelog-apply), Prometheus/OpenTelemetry observability, anti-ransomware canary detection, automated DBVERIFY post-restore validation, and CycloneDX SBOM supply-chain integrity. Bacula Enterprise ships none of these.

Bacula-Native Restore Automation. Competing products require an operator to SSH into the Oracle host and invoke a Perl script (bs_oracle_restore.pl) or an equivalent shell wrapper — outside of any audit trail. PodHeitor uses Bacula’s built-in RestoreObject mechanism: a pluginrestoreconf document embedded in every backup triggers a fully automated, catalogued restore directly from bconsole or the Bacularis web console. No SSH to the Oracle host required.

Who Should Read This

Oracle DBAs evaluating backup strategies for 11g through 23ai workloads.
Bacula Administrators looking to replace a commercial Oracle plugin without re-architecting their infrastructure.
Infrastructure Architects designing disaster-recovery and data-replication pipelines for Oracle Standard Edition 2 or Enterprise Edition environments.
IT Procurement Teams benchmarking licence costs and feature parity against Bacula Enterprise, Veeam for Oracle, Commvault IntelliSnap Oracle, and NetBackup for Oracle.

2. The Problem

Oracle Backup Is Uniquely Complex

Oracle Database backup is unlike backing up a file system or a simple relational database. A correct Oracle backup must account for:

SCN consistency — backups spanning multiple datafiles must be consistent at the same System Change Number or they produce an unrecoverable set.
Archivelog chain integrity — point-in-time recovery requires an unbroken sequence of archived redo logs from the last Full backup to the target time.
Controlfile and SPFILE — the database cannot mount without these; they must be backed up atomically with every datafile backup.
Multitenant (CDB/PDB) — Oracle 12c and later allow hundreds of pluggable databases inside one container; a backup strategy must address both the root container and individual PDBs independently.
TDE encryption — Transparent Data Encryption wallets must be backed up and rotated in a coordinated manner or restore becomes impossible.
ASM and RAC — Grid Infrastructure adds storage abstraction (ASM) and cluster parallelism (RAC) that generic backup tools cannot see.

RMAN (Recovery Manager) is Oracle’s native backup engine and the only tool that fully addresses all of these requirements. Any credible Oracle backup solution must integrate with RMAN at a deep level — not by running rman target / and archiving the output files as if they were arbitrary filesystem objects.

The Cost Problem

Product	Typical Oracle Backup Cost	Notes
Bacula Enterprise	$3,000–$8,000 / year per Oracle host	Oracle Module add-on on top of base FD licence
Veeam for Oracle	$2,500–$6,000 / year per socket	Requires Veeam Backup & Replication Enterprise Plus
Commvault IntelliSnap Oracle	$5,000–$15,000 / year per host	Agent + IntelliSnap licence
NetBackup for Oracle	$4,000–$12,000 / year per host	NBU Client + DB Agent licence
PodHeitor	Per-organisation flat fee — no per-host metering	Commercial support available from author

Pricing ranges are indicative based on publicly available list prices and community reports as of 2026. Actual negotiated prices vary. The point stands: for an organisation protecting 10 Oracle hosts, the annual savings compared to any proprietary solution range from $25,000 to $150,000.

The Restore Problem — The Hidden Cost

The cost of proprietary Oracle backup tools is not just the licence fee. The hidden cost is restore complexity.

Bacula Enterprise 18.2.3 ships a Perl script called bs_oracle_restore.pl. To perform a point-in-time recovery, a DBA must:

SSH into the Oracle host (requires OS access, VPN, key management).
Locate the correct version of bs_oracle_restore.pl (it changes across Bacula releases).
Run the script with the correct parameters — a dozen flags with no interactive validation.
Hope the script generates the right RMAN commands for the target timestamp.
Monitor progress on the Oracle host directly — no Bacula catalog entry for the restore operation.
Manually open the database with RESETLOGS if the script does not do it automatically.

This workflow is error-prone, unauditable, and requires OS-level access that most security policies prohibit granting to application-layer DBAs.

PodHeitor eliminates all of this. The entire restore workflow — including PITR, SCN-based, table-level, clone, and validation actions — is driven from bconsole or the Bacularis web form, with a full audit trail in the Bacula catalog, and zero SSH access required to the Oracle host.

The Replication and CDP Gap

None of the four major competing products (Bacula Enterprise, Veeam, Commvault, NetBackup) includes native continuous data protection (CDP) or disaster-recovery replication for Oracle Standard Edition 2 at the database level without additional Oracle licensing (Active Data Guard requires Oracle Enterprise Edition).

PodHeitor ships:

mode=cdp — a daemon that continuously ships archivelogs to Bacula storage, delivering RPO in minutes rather than hours.
mode=replicate with replicate_method=archivelog_apply — a DR replication channel that works with Oracle Standard Edition 2, Oracle Express Edition, and Oracle 23ai FREE, requiring no Active Data Guard licence.

3. Solution Overview

What the Plugin Delivers

PodHeitor OracleDB Backup Plugin integrates PodHeitor Backup with Oracle RMAN via a clean-room implementation of the Oracle SBT v2 API (libobk-rs.so), delivering five distinct backup modes, fully automated restore, and native DR replication — all from a single 622 KB RPM package.

Five Backup Modes

Mode	Description	Oracle Requirement	Staging Required
`rman_sbt`	Zero-staging RMAN via SBT v2 (`libobk-rs`). Recommended for production.	11g R2+	None — streams directly
`rman`	RMAN writes to local staging; backend streams to Bacula.	11g R2+	Yes — temporary disk
`dump`	Oracle Data Pump (`expdp` / `impdp`) logical backup.	11g R2+ (`exp` on 11g)	Yes — temporary disk
`cdp`	Continuous archivelog daemon. Low-RPO protection.	11g R2+	None
`replicate`	DR replication via Active DG duplicate or archivelog-apply.	SE2 or EE	Optional

Architecture Overview

┌─────────────────────────────────────────────────────────────┐
│                      Bacula Director                        │
│  • Schedules jobs          • Stores RestoreObjects          │
│  • Manages catalog         • Issues bconsole commands       │
└─────────────────────────┬───────────────────────────────────┘
                          │ TCP (Bacula Protocol)
┌─────────────────────────▼───────────────────────────────────┐
│               Bacula File Daemon (FD 15.0.3+)               │
│  • Loads podheitor-oracle-fd.so via plugin API              │
│  • Dispatches bEventBackupCommand / bEventRestoreObject     │
└─────────────────────────┬───────────────────────────────────┘
                          │ PTCOMM (fork + pipe)
┌─────────────────────────▼───────────────────────────────────┐
│          podheitor-oracle-backend (Rust, musl static-pie)   │
│  • Backup dispatcher  • Restore engine  • CDP daemon        │
│  • Metrics (Prometheus) • Canary sampler • Audit logger     │
└────────────┬──────────────────────────────────┬────────────┘
             │ subprocess + UNIX socket          │ subprocess
┌────────────▼────────────┐       ┌─────────────▼───────────┐
│  RMAN (SBT mode)        │       │ sqlplus / expdp / dbv   │
│  → libobk-rs.so (SBT v2)│       │ (non-SBT modes)         │
│  → UNIX socket back     │       │                         │
│    to backend           │       │                         │
└─────────────────────────┘       └─────────────────────────┘
             │
┌────────────▼────────────┐
│    Oracle Database      │
│   (11g R2 → 23ai)       │
└─────────────────────────┘

Restore Automation via RestoreObject

Every backup embeds a pluginrestoreconf RestoreObject in the Bacula catalog. At restore time, the operator selects an action in bconsole or the Bacularis web form — no SSH to the Oracle host is required. The plugin validates the configuration, generates the appropriate RMAN script, optionally runs a RESTORE PREVIEW, executes the restore, and writes a post-restore manifest to the catalog.

DR Replication — Native

mode=replicate with replicate_method=archivelog_apply creates a standby database by:

Running RMAN DUPLICATE to create the initial standby copy.
Continuously shipping and applying archivelogs to the standby host.

This provides Active Data Guard-equivalent protection without Oracle Enterprise Edition licensing — a capability absent from every competitor product listed in this whitepaper.

4. Architecture

4.1 Component Diagram

┌─────────────────────────────────────────────────────────────────────────┐
│  PodHeitor Backup INFRASTRUCTURE                                        │
│                                                                         │
│  ┌────────────────┐   TCP/TLS    ┌──────────────────────────────────┐  │
│  │ bacula-dir     │◄────────────►│ bacula-fd 15.0.3                 │  │
│  │ (Director)     │              │                                  │  │
│  │ • Catalog DB   │              │  ┌────────────────────────────┐  │  │
│  │ • Scheduler    │              │  │ podheitor-oracle-fd.so     │  │  │
│  │ • RestoreObjs  │              │  │ (C++ thin shim, ~3 KB)     │  │  │
│  └────────────────┘              │  │ • Bacula Plugin API        │  │  │
│                                  │  │ • fork() + pipe()          │  │  │
│  ┌────────────────┐   TCP/TLS    │  │ • PTCOMM encode/decode     │  │  │
│  │ bacula-sd      │◄────────────►│  └──────────┬─────────────────┘  │  │
│  │ (Storage)      │              │             │ PTCOMM              │  │
│  └────────────────┘              │  ┌──────────▼─────────────────┐  │  │
│                                  │  │ podheitor-oracle-backend    │  │  │
│                                  │  │ (Rust, x86_64-musl, static) │  │  │
│                                  │  │                             │  │  │
│                                  │  │  backup::run()              │  │  │
│                                  │  │    ├── run_dump()           │  │  │
│                                  │  │    ├── run_rman()           │  │  │
│                                  │  │    ├── run_rman_sbt()       │  │  │
│                                  │  │    ├── run_cdp()            │  │  │
│                                  │  │    └── run_replicate()      │  │  │
│                                  │  │                             │  │  │
│                                  │  │  restore::run()             │  │  │
│                                  │  │    └── run_rman_restore()   │  │  │
│                                  │  │                             │  │  │
│                                  │  │  oracle::sbt_server         │  │  │
│                                  │  │  oracle::audit              │  │  │
│                                  │  │  oracle::canary             │  │  │
│                                  │  │  metrics::http_server       │  │  │
│                                  │  └──────────┬─────────────────┘  │  │
│                                  └─────────────┼──────────────────── ┘  │
└────────────────────────────────────────────────┼────────────────────────┘
                                                 │
                        ┌────────────────────────┼──────────────────────┐
                        │  Oracle Host            │                      │
                        │                         │ UNIX socket          │
                        │  ┌──────────────────────▼──────────────────┐  │
                        │  │ /var/run/podheitor-oracle/<SID>.sock     │  │
                        │  └──────────────────────┬──────────────────┘  │
                        │                         │ SBT v2              │
                        │  ┌──────────────────────▼──────────────────┐  │
                        │  │ libobk-rs.so (clean-room SBT v2 plugin nativo) │  │
                        │  │ symlinked as $ORACLE_HOME/lib/libobk.so  │  │
                        │  └──────────────────────┬──────────────────┘  │
                        │                         │ SBT v2              │
                        │  ┌──────────────────────▼──────────────────┐  │
                        │  │ RMAN (Oracle Recovery Manager)           │  │
                        │  │ N channels, parallel streams             │  │
                        │  └──────────────────────┬──────────────────┘  │
                        │                         │                     │
                        │  ┌──────────────────────▼──────────────────┐  │
                        │  │ Oracle Database (SID=<SID>)              │  │
                        │  │ • Datafiles • Archivelogs • Controlfile  │  │
                        │  │ • SPFILE • TDE Wallet • PDBs             │  │
                        │  └─────────────────────────────────────────┘  │
                        └──────────────────────────────────────────────┘

4.2 mode=rman_sbt Data Flow (Zero-Staging, Recommended)

4.3 mode=cdp — Continuous Data Protection Daemon Loop

4.4 Restore Flow — RestoreObject → RMAN

4.5 Technology Choices

Component	Technology	Rationale
Backend binary	Rust 2021, musl static-pie	Memory safety, zero runtime deps, single-file deploy
FD shim	C++ (Bacula Plugin API)	Bacula requires a C/C++ plugin ABI
IPC protocol	PTCOMM (binary, fork+pipe)	No network socket overhead; deterministic framing
SBT implementation	`libobk-rs` (clean-room Rust plugin nativo)	Proprietary; clean-room reimplementation of Oracle SBT API
SBT ↔ backend IPC	UNIX socket `/var/run/podheitor-oracle/<SID>.sock`	Low-latency, same-host, per-SID isolation
State persistence	JSON files, `/opt/bacula/working/oracle-state/<SID>/`	Human-readable, atomic write-rename
Observability	Prometheus text format, stdlib TCP	Native endpoint, no external dependencies
I/O throttle	cgroups v2 `io.max`	Kernel-enforced, no RMAN-rate guessing
Licence	PodHeitor-Proprietary	Copyright © Heitor Faria — All rights reserved

5. Feature Comparison Table

The following table compares PodHeitor v1.0.0 against Bacula Enterprise 18.2.3, Veeam Backup & Replication for Oracle, Commvault IntelliSnap Oracle, and NetBackup for Oracle.

Legend: Y = Yes/Supported | N = No/Not supported | M = Manual/Requires extra steps | P = Partial | EE = Oracle Enterprise Edition required

5.1 Backup Modes

Feature	Bacula Enterprise 18.2.3	Veeam	Commvault	NetBackup	PodHeitor 1.0.0
RMAN SBT v2 (zero-staging)	Y (proprietary libobk.so)	N	N	Y (nbora)	Y (clean-room libobk-rs.so, Proprietary)
RMAN non-SBT (staging)	Y	N	P	P	Y + zero-staging FIFO option
Data Pump (`expdp`)	P (via dump_pump_opt)	N	N	N	Y (default on 12c+)
exp legacy (11g)	Y	N	N	N	Y
Continuous archivelog (CDP)	N	N	N	N	Y (daemon mode, mode=cdp)
DR replication (SE2 compat)	N	N	N	N	Y (archivelog_apply)
Active DG duplicate	N (sep. licence)	N	N	EE	Y (duplicate_active, no extra licence)

5.2 Incremental and Advanced Backup

Feature	Bacula Enterprise	Veeam	Commvault	NetBackup	PodHeitor
Incremental Level 0/1 RMAN	Y	Y	Y	Y	Y
Incremental FROM SCN	Y	N	N	P	Y + SCN gap detector + resume
Block Change Tracking	Y (manual)	Y	Y	Y	Y (auto-enable + sanity check)
Archivelog backup	Y	Y	Y	Y	Y
Controlfile autobackup	Y	Y	Y	Y	Y
SPFILE / pfile / orapw backup	Y	N	N	P	Y
Multichannel parallel	Y (manual ALLOCATE)	Y	Y	Y	Y (auto-tune by CPU cores/IOPS)
Checkpoint / resume	N	N	N	N	Y (ADR-014, SCN chain)
Archivelog deletion policy	N	N	N	N	Y (archivelog_keep_backed_up=N)
AWR snapshot at end of Full	N	N	N	N	Y (awr_snapshot=yes)

5.3 Topology and Multitenant

Feature	Bacula Enterprise	Veeam	Commvault	NetBackup	PodHeitor
Oracle 11g R2	Y	N	P	Y	Y
Oracle 12c / 18c / 19c / 21c	Y	Y	Y	Y	Y
Oracle 23ai	P	P	N	P	Y (live validated)
RAC auto-discovery	M	N	Y	Y	Y (auto + per-node parallel)
CDB/PDB multitenant	Y (implicit)	Y	Y	Y	Y (per-PDB parallel + selective)
Data Guard role gate	Y (implicit)	N	P	Y	Y (prefer_standby=no/yes/auto)
ASM path handling	Y	Y	Y	Y	Y (asmcmd resolution + dbv filter)
Cross-endian restore (Solaris→Linux)	M (manual)	N	N	P	Y (RMAN CONVERT DATAFILE auto)
TDE wallet backup	Y	P	P	P	Y (master-key rotation aware)

5.4 Restore Automation

Feature	Bacula Enterprise	Veeam	Commvault	NetBackup	PodHeitor
Restore without SSH to Oracle host	N	N	N	N	Y (bconsole only)
Audit trail in Bacula catalog	N	N	N	N	Y (full JobLog + manifest)
PITR (point-in-time recovery)	M (perl script)	M	M	M	Y (1-shot, action=pitr)
SCN-based restore	M	N	N	M	Y (1-shot, action=scn)
Table-level recovery (12c+)	M	N	N	M	Y (1-shot, action=table)
Clone to different host/SID	M (beta)	M	M	M	Y (action=clone)
RESTORE PREVIEW before execute	N	N	N	N	Y (preview_first=yes)
VALIDATE DATABASE after restore	N	N	N	N	Y (verify_after=yes)
Dry-run mode	N	N	N	N	Y (dry_run=yes)
Flashback Database	N	N	N	N	Y (action=flashback)
Bacularis web form for restore	N	N/A	N/A	N/A	Y (native Bacularis integration)

5.5 Compression and Throttling

Feature	Bacula Enterprise	Veeam	Commvault	NetBackup	PodHeitor
RMAN BASIC/MEDIUM/HIGH	Y	Y	Y	Y	Y
zstd / lz4 pre-SBT pipe	N	N	N	N	Y (double-compression option)
RMAN RATE throttle	Y	Y	Y	Y	Y
cgroups v2 I/O throttle	N	N	N	N	Y (cgroup_write_bps=)

5.6 Observability and Supply Chain

Feature	Bacula Enterprise	Veeam	Commvault	NetBackup	PodHeitor
Prometheus /metrics endpoint	N	N	N	N	Y (metrics_addr=host:port)
Anti-ransomware canary	N	Y (separate)	Y (separate)	Y (separate)	Y (built-in, block-hash sampler)
Audit-log credential redaction	N	N	N	N	Y (passwords/keys never in logs)
DBVERIFY post-restore	N	N	N	N	Y (automated)
Dry-run preflight	N	N	N	N	Y (–dry-run flag)
Reproducible builds	N (proprietary)	N	N	N	Y (static-pie musl, Cargo.lock)
SBOM (CycloneDX)	N	N	N	N	Y (make sbom)
CVE audit (cargo-audit + cargo-deny)	N	N	N	N	Y (0 CVEs, 78 crate deps)

6. Backup Options Reference

All parameters are specified in the Bacula Plugin = directive inside a FileSet block. Parameters may also be placed in the config file (default: /opt/bacula/etc/podheitor-oracle.conf) as key=value lines — plugin-line parameters always override config-file values.

6.1 Connection and Identity

Parameter	Type / Valid Values	Default	Description	Since
`sid`	string	`*` (all detected)	Oracle SID (instance name). Use `*` to auto-detect all running instances.	1.0.0
`oracle_home`	path	`auto`	`$ORACLE_HOME` path. `auto` reads from `/etc/oratab` or `oraenv`.	1.0.0
`oracle_user`	string	`/ as sysdba`	OS user to connect as. Set to `oracle` for OS authentication.	1.0.0
`unix_user`	string	`oracle`	OS account the backend switches to before spawning RMAN/sqlplus.	1.0.0
`use_sudo`	bool	`no`	Prefix oracle commands with `sudo -u <unix_user>` instead of setuid.	1.0.0
`auth`	`os`	`pwfile:<path>`	`walletconn:<alias>`	`os`	Authentication method. `os` = `/ as sysdba`. `pwfile:` = password file. `walletconn:` = Oracle Wallet TNS alias.	1.0.0
`config_file`	path	`/opt/bacula/etc/podheitor-oracle.conf`	Override path to the config file.	1.0.0
`instance`	string	`*`	RAC instance filter. `*` = all instances.	1.0.0
`verbose`	0–3	`0`	Verbosity level for Bacula job log.	1.0.0
`debug`	0–9	`0`	Debug level; ≥5 enables PTCOMM frame dumps.	1.0.0
`trace`	path	“	Write trace log to file (in addition to Bacula job log).	1.0.0

6.2 Backup Mode

Parameter	Type / Valid Values	Default	Description	Since
`mode`	`rman_sbt`	`rman`	`dump`	`cdp`	`replicate`	`dump`	Backup mode. `rman_sbt` is recommended for production.	1.0.0

6.3 RMAN Options (applicable to mode=rman and mode=rman_sbt)

Parameter	Type / Valid Values	Default	Description	Since
`channels`	`auto`	1–64	`auto`	Number of RMAN backup channels. `auto` tunes to CPU core count.	1.0.0
`auto_tune_channels`	bool	`yes`	When `channels=auto`, dynamically adjust channel count based on available cores.	1.0.0
`bct`	`auto`	`on`	`off`	`auto`	Block Change Tracking. `auto` enables if not already enabled.	1.0.0
`archivelog`	`include`	`exclude`	`only`	`include`	Archivelog handling. `include` = back up after datafiles. `only` = archivelog-only backup.	1.0.0
`archivelog_keep_backed_up`	0–99	`0`	Delete archivelogs from FRA after N backup copies. 0 = disabled.	1.0.0
`max_rate_mb`	0–99999	`0` (unlimited)	RMAN per-channel rate limit in MB/sec. 0 = no limit (use `cgroup_write_bps` for cgroups-based throttle).	1.0.0
`ctrlfile`	path	`/tmp/oracle`	Staging path prefix for controlfile autobackup.	1.0.0
`hooks_dir`	path	`/opt/bacula/etc`	Directory scanned for `oracle_before_.rman` / `oracle_after_.rman` hook scripts.	1.0.0

6.4 Compression

Parameter	Type / Valid Values	Default	Description	Since
`compress`	`none`	`zstd`	`lz4`	`gzip`	`rman_basic`	`rman_medium`	`rman_high`	`zstd`	Compression algorithm. `rman_*` uses RMAN native compression inside the RMAN block. `zstd`/`lz4`/`gzip` applies pipe-level compression before sending to Bacula.	1.0.0
`compress_level`	1–22 (zstd), 1–9 (gzip)	`3`	Compression level (applies only to zstd and gzip).	1.0.0

6.5 Channels and Parallelism

Parameter	Type / Valid Values	Default	Description	Since
`parallel_dbs`	1–64	`4`	Maximum databases to back up in parallel (when `sid=*`).	1.0.0
`parallel_pdbs`	1–64	`4`	Maximum PDBs to back up in parallel within a CDB.	1.0.0
`parallel_nodes`	0–64	`0` (all)	Maximum RAC nodes to use concurrently. 0 = all discovered.	1.0.0
`prefer_standby`	`no`	`yes`	`auto`	`no`	Data Guard role gate. `no` = backup on PRIMARY only. `yes` = require physical standby. `auto` = run on any physical-capable role.	1.0.0

6.6 Multitenant (CDB/PDB)

Parameter	Type / Valid Values	Default	Description	Since
`pdbs`	`*`	comma-separated names	`*`	PDB name filter. `*` = all PDBs. Example: `pdbs=PDB1,PDB2`.	1.0.0
`pdb_skip_seed`	bool	`yes`	Skip `PDB$SEED` (the read-only seed PDB) in multitenant backups.	1.0.0
`exclude_tablespace`	comma-separated names	“	Tablespace names to exclude from backup.	1.0.0
`exclude_pdb`	comma-separated names	“	PDB names to exclude from backup.	1.0.0

6.7 TDE Wallet

Parameter	Type / Valid Values	Default	Description	Since
`wallet_backup`	bool	`yes`	Include TDE wallet backup in the job.	1.0.0
`wallet_path`	path	`auto`	`auto`	Path to the Oracle Wallet directory. `auto` reads from `sqlnet.ora`.	1.0.0
`wallet_passphrase_file`	path	“	File containing the wallet open passphrase. Permissions must be 600.	1.0.0

6.8 Data Pump (mode=dump)

Parameter	Type / Valid Values	Default	Description	Since
`dump_format`	`expdp`	`exp`	`expdp`	Use Data Pump (`expdp`) or legacy export (`exp`). Forced to `exp` on 11g.	1.0.0
`dump_opt`	string	`CONSISTENT=Y GRANTS=y`	Extra options appended to the `exp` command line.	1.0.0
`dump_pump_opt`	string	“	Extra options appended to the `expdp` parfile (e.g. `EXCLUDE=STATISTICS`).	1.0.0
`schema`	`*`	comma-separated	`*`	Schema (owner) filter for Data Pump export. `*` = all schemas.	1.0.0

6.9 Continuous Data Protection (mode=cdp)

Parameter	Type / Valid Values	Default	Description	Since
`cdp_poll_interval`	1–3600 (seconds)	`5`	How often (seconds) the CDP daemon polls `v$archived_log` for new logs.	1.0.0
`cdp_max_lag`	1–86400 (seconds)	`300`	RPO alarm threshold in seconds. Triggers `PODHEITOR-ORACLE-AUDIT kind=cdp_lag_exceeded` when exceeded.	1.0.0

6.10 Replication (mode=replicate)

Parameter	Type / Valid Values	Default	Description	Since
`replicate_method`	`duplicate_active`	`archivelog_apply`	`duplicate_active`	`duplicate_active` = RMAN DUPLICATE FROM ACTIVE DATABASE (EE). `archivelog_apply` = bootstrap + continuous log apply (SE2 compatible).	1.0.0
`target_sid`	string	“	Standby database SID (required for replicate mode).	1.0.0
`target_host`	string	“	Standby host FQDN or IP.	1.0.0
`target_oracle_home`	path	“	`$ORACLE_HOME` on the standby host.	1.0.0

6.11 Validation (post-backup integrity check)

Parameter	Type / Valid Values	Default	Description	Since
`validate_after`	bool	`yes`	Run `RMAN VALIDATE BACKUPSET` after every backup job.	1.0.0

6.12 Anti-Ransomware Canary

Parameter	Type / Valid Values	Default	Description	Since
`canary`	bool	`no`	Enable block-hash sampling canary. Detects mass datafile changes between backup runs.	1.0.0
`canary_blocks`	1–4096	`64`	Number of random blocks sampled per datafile per canary check.	1.0.0
`canary_threshold_pct`	1–100	`25`	Percentage of changed blocks that triggers a `PODHEITOR-ORACLE-CANARY-ALERT` message.	1.0.0

6.13 Observability

Parameter	Type / Valid Values	Default	Description	Since
`metrics_addr`	`host:port`	`0`	`0` (disabled)	Bind address for Prometheus HTTP `/metrics` endpoint. Example: `0.0.0.0:9119`.	1.0.0
`cgroup_write_bps`	0–(uint64)	`0` (disabled)	cgroups v2 I/O write throttle in bytes/sec. Requires the backend process to be in a cgroup v2 hierarchy.	1.0.0
`awr_snapshot`	bool	`no`	Create an AWR snapshot at end of each Full backup and write HTML performance report to state dir. Non-fatal on XE/SE2.	1.0.0
`goldengate_aware`	bool	`no`	Detect active GoldenGate processes and emit their SCN checkpoint before each backup.	1.0.0

6.14 Hooks

Hook files are placed in hooks_dir (default /opt/bacula/etc). The backend scans for files matching these patterns before and after RMAN execution:

Hook File	Trigger	Notes
`oracle_before_full_backup.rman`	Before Full RMAN backup	Enterprise-compatible naming
`oracle_after_full_backup.rman`	After Full RMAN backup	Extension: after-hooks are PodHeitor-only
`oracle_before_incremental_backup.rman`	Before Incremental backup
`oracle_after_incremental_backup.rman`	After Incremental backup
`oracle_before_full_backup_<SID>.rman`	Before Full — SID-specific	Takes priority over generic hook
`oracle_after_full_backup_<SID>.rman`	After Full — SID-specific

7. Restore Options Reference

Restore options are delivered via the pluginrestoreconf RestoreObject, which is embedded in every backup and rendered as interactive prompts in bconsole or as a form in Bacularis. Keys follow INI-style key = value syntax with # comments.

7.1 Core Fields (all actions)

Key	Type / Valid Values	Default	Description
`action`	`pitr`	`scn`	`table`	`clone`	`full`	`preview`	`validate`	`flashback`	`preview`	Restore action to perform. Required.
`auto_open_resetlogs`	bool	`yes`	Automatically issue `ALTER DATABASE OPEN RESETLOGS` after RECOVER DATABASE.
`shutdown_if_open`	bool	`yes`	Issue `SHUTDOWN IMMEDIATE` before restore if the database is open.
`parallelism`	`auto`	1–64	`auto`	Number of RMAN restore channels. `auto` matches the original backup channel count.
`verify_after`	bool	`yes`	Run `RMAN VALIDATE DATABASE CHECK LOGICAL` + DBVERIFY after restore.
`preview_first`	bool	`no`	Run `RESTORE DATABASE PREVIEW` before executing the restore. Outputs a plan without modifying the database.
`require_explicit_confirmation`	bool	`yes`	For destructive actions, prompt the operator to type `yes` in bconsole before proceeding.
`dry_run`	bool	`no`	Parse and validate the configuration, generate the RMAN script, print it to the job log, but do not execute.