Backing Up Oracle TDE on an Encrypted Database

1. If Oracle is not running, login as sysdba and run the startup.

   Copy

   su - oracle 
   sqlplus / as sysdba 
   sql> startup;

2. If the database is running in NOARCHIVELOG mode, change it to ARCHIVELOG mode.

   Copy

   sql> shutdown immediate;
   sql> startup mount;
   sql> alter database archivelog;
   sql> alter database open;

3. Exit the sqlplus session and connect to the rman session.

   Copy

   rman target /

4. List any existing backup files.

   Copy

   rman> list backup;

5. If there are any backup files, optionally delete them.

   Copy

   rman> delete backup;

6. Display the default configuration for rman.

   Copy

   rman> show all;

7. Set the backup and configuration file location and the file name format of the backup files. If the path doesn't exist, create it using the following:  mkdir -p /u02/backup/ORCL/

   Copy

   rman> CONFIGURE CHANNEL DEVICE TYPE DISK FORMAT '/u02/backup/ORCL/ORCL_BKP_%U';
   rman> CONFIGURE controlfile autobackup on;

8. Create the backup with archive logs.

   Copy

   rman> BACKUP DATABASE PLUS ARCHIVELOG;

9. Create the init file using the pfile.

   Copy

   cd $ORACLE_HOME/dbs/
   sqlplus / as sysdba
   
   sql> create pfile from spfile;

10. After the backup is completed, identify the encryption key using the following query as sysdba on the source machine.

    Copy

    sqlplus / as sysdba
    startup;
    select KEY_ID,KEY_USE from V$ENCRYPTION_KEYS; 

    Search for the section called "Current database master encryption key/s in use".