Skip to main content
BOW has two read-only connectors for the IBM Db2 family. Both read the tables, views, and columns in the schemas you point them at, including their comments and primary and foreign keys, and run Db2 SQL against them. Both connectors support one shared credential for the whole workspace or per-user credentials, where each person saves their own login.
Per-user authentication on a database connector requires an Enterprise license. See Authentication.

Read-only queries

Queries on both connectors are limited to a single statement that starts with SELECT, WITH, or VALUES. Anything else is refused before it reaches the server, as are write keywords inside a query (including SELECT … FROM FINAL TABLE (INSERT …)) and Db2-specific statements and routines that change state, such as QCMDEXC, ADMIN_CMD, SYSPROC routines, LOCK, REFRESH, RUNSTATS, and REORG. The IBM i connector also opens every database job with read-only access, so the IBM i itself refuses writes.
This check is a safeguard, not a substitute for a read-only account: a SELECT can still call a function with side effects. Connect with a user that has read-only access, limited to the schemas or libraries the agent should use. The agent only sees the tables you select, but a query naming another table on these connectors is not blocked, so database permissions are what limit it.

IBM Db2 (LUW and z/OS)

Go to Data Sources → Add data source → IBM Db2.
IBM publishes no ibm_db driver for Linux ARM64, so IBM Db2 does not appear in the picker when BOW runs on an ARM64 Linux host. Run BOW on an x86_64 host to use it. IBM i (Db2 for i) works on every architecture.

Connection fields

Credentials (Username / Password):

Product detection

With Db2 product set to auto, BOW reads the product from the server on first connect and reads the matching system catalog: SYSCAT on LUW, SYSIBM on z/OS, and QSYS2 on IBM i. A successful connection test names the detected product and its version, for example Successfully connected to Db2 LUW 12.01.0500. When Schema is empty, system schemas are skipped: names starting with SYS, plus NULLID and SQLJ, and on z/OS also names starting with DSN.

Db2 for z/OS and the Db2 Connect license

Db2 for z/OS — and Db2 for IBM i reached through this connector — accept ibm_db connections only with a Db2 Connect entitlement, either activated on the server (db2connectactivate, the usual case on z/OS) or installed as a client license file in the driver’s clidriver/license folder on the BOW host. Without one, the server answers SQL1598N, and the connection test says that a Db2 Connect license is required and how to provide it. If you connect to an IBM i and have no Db2 Connect license, use the IBM i (Db2 for i) connector instead.

IBM i (Db2 for i)

The IBM i (Db2 for i) connector talks to IBM’s open-source Mapepire server on the IBM i. It needs no Db2 Connect license and no ODBC driver, and works on every architecture BOW runs on.

Before you start

Install and start the Mapepire server on the IBM i once:
Mapepire listens on port 8076 by default. Make sure that port is reachable from the BOW host.

Connect in BOW

Go to Data Sources → Add data source → IBM i (Db2 for i). Credentials (User profile / Password): When Libraries is empty, system libraries are skipped: names starting with Q or SYS, plus SQLJ. To index a library whose name starts with Q, list it in Libraries.

Server certificate

Mapepire generates a self-signed certificate unless you install one. With Verify TLS certificate on, BOW checks the server certificate and host name against the certificate you paste in Server Certificate (PEM), or, if that is empty, against the BOW host’s system trust store. An unknown self-signed certificate is refused. So, for a default Mapepire install, paste its certificate into Server Certificate (PEM). Turn Verify TLS certificate off only on a trusted network.

Writing queries

Queries use SQL naming — LIBRARY.TABLE, not LIBRARY/TABLE. Libraries are schemas.

Troubleshooting