Skip to main content

How to Set Up IBM Db2 for z/OS

Setup takes about 10–20 minutes.

Introduction

Connecting IBM Db2 for z/OS (mainframe) to Foundational allows Foundational to scan metadata, determine lineage, and assess downstream impact for Db2 schemas, tables, views, and bound packages.

To make the connection, you need to:

  • Create a read-only database user on your z/OS system
    ​

  • Grant the user SELECT access to the required Db2 catalog tables
    ​

  • Connect to Foundational using your Db2 connection details

Prerequisites

Ensure you have:

  • A Db2 for z/OS subsystem accessible over the network via the DRDA protocol (TCP/IP).
    ​

  • The LOCATION name of your Db2 subsystem (the subsystem alias, e.g., DSNP). This is the value used in DRDA connection strings to identify the target subsystem, see the article IBM: Location Names.
    ​

  • The hostname and port of the DRDA listener. The default z/OS DRDA port is 446, though some customers remap to a custom port (e.g., 5022, 5023).
    ​

  • A RACF (or equivalent security manager) administrator who can create a user ID and run GRANT statements against the Db2 catalog, see the IBM article Managing security with the RACF access control module.
    ​

  • Added Foundational IP addresses to your network allowlist so the scanner can reach the DRDA listener. For the list of Foundational IP addresses, see the article Allowing IP access to Foundational.

Access permissions

Foundational requires a dedicated read-only user. It reads exclusively from the Db2 catalog tables in SYSIBM and never touches user data.

Have your DBA run the following statements, replacing <FOUNDATIONAL_USER> with the user ID you created:

-- Core catalog: tables, columns, views, synonyms, schemas
GRANT SELECT ON SYSIBM.SYSTABLES    TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSCOLUMNS   TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSVIEWS     TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSSYNONYMS  TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSDATABASE  TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSSCHEMATA  TO USER <FOUNDATIONAL_USER>;

-- Bound packages: COBOL/PL-I embedded SQL lives here
GRANT SELECT ON SYSIBM.SYSPACKAGE   TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSPACKSTMT  TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSPACKDEP   TO USER <FOUNDATIONAL_USER>;

-- Routines, triggers, and foreign keys
GRANT SELECT ON SYSIBM.SYSROUTINES  TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSTRIGGERS  TO USER <FOUNDATIONAL_USER>;
GRANT SELECT ON SYSIBM.SYSRELS      TO USER <FOUNDATIONAL_USER>;

On many z/OS installations, SELECT on SYSIBM.* is already granted to PUBLIC by default, which means these GRANTs are a no-op. Check with your DBA before running them.

The table below describes what each catalog group is used for.

Catalog Tables

Purpose

SYSTABLES, SYSCOLUMNS, SYSDATABASE, SYSSCHEMATA

Enumerate schemas, tables, and columns

SYSVIEWS

Read view DDL to extract column-level lineage

SYSSYNONYMS

Resolve table aliases

SYSPACKAGE, SYSPACKSTMT, SYSPACKDEP

Read bound-package SQL (COBOL / PL-I embedded SQL) for lineage

SYSROUTINES, SYSTRIGGERS

Extract lineage from stored procedures and triggers

SYSRELS

Map foreign-key relationships between tables

For the full GRANT syntax, see IBM: GRANT (table privileges).

Connect IBM Db2 to Foundational

  1. In Foundational, open the Connectors & Integrations page.
    ​

  2. In Data Stores, select the IBM Db2 card and click Connect.
    ​

  3. A new screen opens. Click Add Account.
    ​

  4. The initial setup screen opens. Click Start Setup.

  5. The Set Up New Connection screen opens.

    Enter the details:
    ​

    • Hostname: The DNS name or IP address of the Db2 DRDA listener
      (e.g., db2lpar1.corp.example.com).
      ​

    • Port: The TCP port of the DRDA listener. The z/OS default is 446; confirm with your DBA if a custom port is used.
      ​

    • Location: The Db2 z/OS LOCATION name. Enter the subsystem alias used in DRDA connections (e.g., DSNP). This is not a database name in the relational sense; it identifies the z/OS subsystem.
      ​

    • Username: The read-only user ID you created (e.g., LINEAGE).
      ​

    • Password: The password for that user ID.
      ​

  6. Click Next.
    ​

  7. The final setup screen opens. To complete the connection, click Save.


    Foundational validates the connection credentials. Once validated, the connector appears in your connector list, and Foundational begins scanning your Db2 catalog.

What Foundational scans

After setup, Foundational reads the following from your Db2 system:

  • Tables and views: Schema, name, type, and owning database
    ​

  • Columns: Name, data type, nullability, and ordinal position
    ​

  • View DDL: Reassembled from SYSIBM.SYSVIEWS to extract column-level lineage
    ​

  • Synonyms: Resolved to their base tables for lineage traversal
    ​

  • Bound packages: SQL statements stored in SYSIBM.SYSPACKSTMT (COBOL/PL-I embedded SQL) parsed for source-to-target lineage
    ​

  • Stored procedures and triggers: Bodies parsed for implicit data flows
    ​

  • Foreign keys: Relationship metadata between tables

No row-level data is read. Foundational only queries the SYSIBM catalog.

That's it. Foundational is now connected to IBM Db2.

Related Articles
How to set up Snowflake
How to set up GitHub
How to Set up Hive
How to set up Oracle Data Warehouse
How to Set up Databricks
Did this answer your question?