Release Notes
Abstract
This document provides important information about IBM Workload Scheduler Version 10.2.6
Content
IBM Workload Scheduler version 10.2.6 Release Notes
Release date: 2025, December 15
This document provides important information about IBM® Workload Scheduler version 10.2.6.
You can obtain dynamic and up-to-date reports by browsing to Software Product Compatibility Reports and selecting the information you are interested in.
This document is divided into the following main sections:
- Features introduced with version 10.2.6
- APARs fixed in version 10.2.6
- Resolved Common Vulnerabilities and Exposures (CVEs)
- Interoperability tables
- Known limitations and workarounds
- Package structure
- Software requirements for WebSphere Application Server Liberty Base
- Installing and upgrading to version 10.2.6
- Performing the centralized agent update on a stand-alone fault-tolerant agent
- Documentation updates
- Contacting IBM Workload Scheduler Software Support
- Notices
Features introduced with version 10.2.6
IBM Workload Scheduler version 10.2.6 contains the following enhancements:
- Introducing proactive observability: monitor IBM Workload Scheduler like never before with Instana
- Multiple workspaces: enhancing design flexibility
- Remote-to-remote File Transfer integration
- Centralized JWT Signing Key Management
- Certman security enhancements: automated validation & OpenSSL integration
- Enhanced OQL filtering: the
STARTEDalias - New in Orchestration Monitor: update agent certificates remotely
- Changed features, improvements, and RFEs in version 10.2.6
Helpful videos demonstrating new features are available on Workload Automation YouTube channel.
Important information for version 10.2.6
Starting with IBM Workload Scheduler version 10.2.6, the Workload Definitions section for version 9.x connected engines will be removed from the Dynamic Workload Console. Therefore, the following pages will no longer be available:
- Manage Workload Definitions
- List Workload Definitions
- Import Workload Application
- Manage Event Rules
- Create Workstations
- List Workstations
APARs fixed in version 10.2.6
This section lists APARs resolved in version 10.2.6, divided by component, as follows:
- Table 1. Engine - APARs fixed in this release
- Table 2. Installation process - APARs fixed in this release
- Table 3. Command-line - APARs fixed in this release
- Table 4. Docker - APARs fixed in this release
- Table 5. Dynamic Domain Manager - APARs fixed in this release
- Table 6. HCL Workload Automation for Z connector - APARs fixed in this release
- Table 7. Integration with SAP and PeopleSoft – APARs fixed in this release
- Table 8. REST APIs – APARs fixed in this release
- Table 9. Documentation – APARs fixed in this release
| Code | Description |
|---|---|
| IJ12526 | Duplicate job stream entries were erroneously generated and added to the plan following the execution of the JnextPlan command, leading to potential confusion and operational issues.This defect manifests particularly with hourly recurring job streams defined to run throughout the day (e.g., EVERY 0100), even when the STARTOFDAY (SD) global option is set to midnight (0000). |
| IJ35898 | Misleading error message when deleting a resource sharing the same name as an existing resource defined on a different workstation.An incorrect error message was displayed when an administrator attempted to delete a resource object that shared the same name as another resource but was defined on a different workstation. |
| IJ48015 | Unable to view or edit dynamic domain manager pool workstations after upgrading to version 10.1.A defect prevented administrators from successfully viewing or editing dynamic domain manager pool workstations after upgrading the environment to version 10.1. |
| IJ48789 | Agents are not sending job status to the master domain managerA defect in the job management mechanism caused agents not to send job status updates to the master domain manager. This failure resulted in the continuous increase in size of the job table directory because completed job files were not properly cleaned up or communicated to the master domain manager. |
| IJ50063 | Recovery jobs have incorrect job names in conamn showjob in stdlist format.A defect in the plan status reporting caused the conamn showjob command to display an incorrect job name for recovery jobs. When you used the command to retrieve the standard list (stdlist) output for a job stream containing a recovery job, the output incorrectly referenced the original job name instead of the system-generated recovery job name. |
| IJ50624 | JSON Web Tokens (JWT) are not renewed when certificates are rotated on the master domain manager.A defect in the security mechanism caused JWT to fail renewal following the successful rotation of SSL certificates on the master domain manager. |
| IJ51132 | The security token cannot be validated message in trace.log.A configuration issue or defect causes the application server to fail to validate security tokens, leading to recurring |
| IJ51210 | rmstdlist script failing to delete non-empty directories.A defect in the |
| IJ51847 | The server.xml file uses hard-coded key alias instead of the relevant variable retrieved from the jwt_variables.xml file.A defect in the master domain manager configuration caused the server.xml file to use a hard-coded reference for the key alias within its security configuration. |
| IJ53156 | Vulnerability in LIBCURL (CVE-2024-7264).Need to fix vulnerability CVE-2024-7264. |
| IJ53898 | Dynamic agent unlinking due to Java heap space consumption.Dynamic agents encountered frequent Java Heap Space exhaustion, leading to the agent repeatedly unlinking from the master domain manager. Increasing available memory did not solve the issue. Memory consumption issue was tied specifically to the RESTful plugin. |
| IJ53988 | The backup master domain manager stops working due to low memory and database connection deadlock.A timing-dependent defect caused the backup master domain manager to stop responding. The issue is due to a timing conflict within the database connection pooling logic, where a request for a new connection clashed with an existing connection attempting to access a configuration file. |
| IJ54174 | Unable to change user password in the plan if the password contains a backslash character.A defect prevents users from successfully changing their password using the alter user password in plan function when the new password string includes the backslash character. |
| IJ54208 | Rerun job log differs from initial job run logThe job log generated after rerunning a job was different from the job log generated when running the same job for the first time. |
| IJ54326 | Memory consumption increase in master domain manager.A defect in the scheduling engine caused the memory utilization on the master domain manager to continually increase. The Java process was unable to release memory resources effectively, leading to a progressive memory leak or inefficient resource management. |
| IJ54823 - KB0121311 | File transfer job integration fails with null pointer exception when processing a high number of files.A critical defect in the File Transfer integration caused the job to fail with a Null Pointer Exception (NPE) when processing a large number of files. The underlying file management code experienced a logic failure when handling the resource list, which led to the NPE and prematurely terminated the file transfer job, preventing the completion of bulk transfer tasks. |
| IJ54937 | When setting an incorrect frequency for the movehistorydata command, the resulting system message was misleading. The message erroneously stated that the command operational frequency was set to 60 minutes, when the true system default is 5 minutes.When an incorrect value was set, the system incorrectly ran the utility every 5 minutes, rather than reverting to the default frequency of 60 minutes, as stated in the message. This discrepancy between the expected default and the actual operational behavior created unforeseen system load and potential performance risks. |
| IJ55004 | Jobs completing in error due to read-only user home directory.A product defect caused job execution to fail with EXIT STATUS: 127 and the following error "script.sh: Text file busy" when attempting to run a job. This problem occurred specifically on environments where the user HOME directory was configured on a read-only file system. |
| IJ55087 | Multiple job streams with rerun cause high CFJOB messages.A performance defect causes the |
| IJ55241 - KB0122349 | WebSphere Application Server Liberty crashes frequently generating JavaCore dump files.A product defect caused WebSphere Application Server Liberty to crash frequently, resulting in the generation of JavaCore dump files. This instability occurred when the server invoked the native library LIBTWSPLANJNI.SO (Java Native Interface), indicating an issue within the JNI layer during plan-related operations. |
| IJ55288 | When creating a new security domain with Security object type USEROBJ, it is impossible to set the CPU and CPUFOLDER attributes.A defect in the object handling logic caused the CPUFOLDER attribute to be erroneously deleted or ignored from the USEROBJ security object definition after modification using the composer mod sdom command. When administrators explicitly included CPUFOLDER in the USEROBJ instruction, the attribute was not maintained when editing or saving the security domain. |
| IJ55357 | Need to address a number of vulnerabilities in Apache Commons.Vulnerabilities to be addressed: CVEs: CVE-2025-48795, CVE-2025-48924, CVE-2025-4892, CVE-2012-5783 |
| IJ55366 | Folder path separator removed from recovery job names.A defect in the code causes the folder path separator character (the forward slash, |
| IJ55398 | The SwitchPlan script completes in error due to a memory fault when stopping a fault-tolerant agent defined in a folder.The issue occurred while running the conman stop @!/@/@;wait;noask command, which uses a wildcard to target all workstations, including those defined in folders. The code failed to properly handle the memory allocation when processing the large, complex list of folder-based workstation names generated by the wildcard, leading to the memory fault. |
| IJ55401 | optman option enDbGetOpsAudit not working, impacting performance of composer tasks.A defect in the audit logging mechanism caused the optman option enDbGetOpsAudit (dg) to stop working in version 10.2.2, leading to severe performance degradation. This option, intended to suppress the logging of routine database GET operations, was ignored even when set to 0. Consequently, every database retrieval action was logged to the audit JSON file, which significantly increased the execution time of composer procedures. |
| IJ55702 | Job stream instances scheduled after 12 AM fail to load into the plan when the STARTOFDAY global option was configured to a time other than 12 AM.A defect in the plan generation logic caused job stream instances scheduled with hourly recurrence to fail to load into the current plan for times occurring after the midnight boundary (12 AM). |
| IJ55718 | Dynamic agents installed on AIX randomly crash. This instability occurred across multiple releases.The crash resulted in the generation of core files at the agent level, forcing the affected agents offline and disrupting scheduling operations. The issue suggested a recurrent internal stability problem specific to the AIX environment within the dynamic agent process. |
| IJ55842 | The planman resync command takes excessive time after SwitchPlan command.A defect in the plan synchronization mechanism caused the planman resync operation, specifically following a SwitchPlan command, to randomly take an excessive amount of time to complete, significantly exceeding standard behavior. |
| IJ56306 | The agent for z/OS (also known as d-driven agent) cannot connect to the dynamic domain manager (also known as broker server) version 10.2.4 and returns error |
| KB0121156 | WebSphere Application Server Liberty restarts frequently when installed with IBM Workload Scheduler version 10.2.3.A critical product defect caused the WebSphere Application Server Liberty on the master domain manager 10.2.3, Linux OS) to restart frequently, generating multiple Java core files with error AWSBDJ003E The application server has stopped unexpectedly or failed.. |
| KB0122051 | Agent using JWT unlinks after master domain manager certificate renewal.A defect caused agents configured to use JSON Web Token (JWT) authentication to disconnect or unlink from the master domain manager following the rotation of SSL certificates rotation on the master domain manager. |
| KB0122821 | A defect was identified in the cleanuserjobs.sh script that caused execution to fail when the environment utilized a PostgreSQL database.A defect in the cleanuserjobs.sh script caused a failure with the database error AWKCLI102E when the environment utilized a PostgreSQL database. |
| KB0123037 | jsuntil time not evaluated properly when the job stream uses a different time zone.A defect in the scheduling logic caused the jsuntil time to be evaluated incorrectly when a job stream was defined with a time zone that differed from the system and CPU time zones. |
| KB0123390 | IBM Workload Scheduler processes cause SYN flooding on Azure hosts.A product defect caused SYN flooding to occur on Azure hosts running SLES 15 SP06 when the |
| KB0123509 | Errors returned when fetching large job logs.A defect in the job log retrieval mechanism caused the system to return errors when attempting to view or fetch large job logs (observed for file sizes 1 MB or greater). This problem occurred specifically for native jobs, not Java jobs. |
| KB0123693 | Job NOP/HOLD status modification failure due to Access Control List (ACL) restrictions: a defect in the ACL evaluation prevented users from modifying the No Operation (NOP) or HOLD status on job definitions when the modification initiated from the planning level.The system erroneously required high-level design/model permissions (such as modify rights) to perform a simple operational status change, even when the user possessed the specific operational permissions. |
| KB0123694 | SAP jobs fail on extended agent due to .sth file read permission error.A defect introduced by the new 3DES to AES encryption mechanism caused SAP jobs running on an extended agent to fail with the error EEWO0012E (The extended agent could not be initialized). |
| KB0124564 | RESTful API job with callback hangs due to backup master domain manager handling.A recurring issue caused RESTful API type jobs configured with a callback feature to hang and never return a completion status after submission, specifically in complex environments utilizing a load balancer. |
| Code | Description |
|---|---|
| IJ39603 | Oracle SQL scripts fail during manual database configuration.A defect in the database configuration utility, when generating manual SQL scripts for Oracle environments (using configureDb.sh -execsql false), caused the resulting scripts to return an error. The generated files contained formatting errors, including trailing backslashes ( |
| IJ40294 | z-centric agent skips |
| IJ41121 | DWCRest.war does not customize the database schema name.A defect in the installation process prevents the Dynamic Workload Console (DWC) REST API component from correctly customizing the database schema name. |
| IJ41406 | The twsinst generates false error during upgrade due to wrong SWIDTAG file reference.A defect in the twsinst upgrade logic caused it to incorrectly search for the wrong Software ID (SWID) tag file during the upgrade of a dynamic agent. |
| IJ44938 | Events on an extended agent fail when the agent is defined within a folder.A defect in the event handling mechanism caused event rules configured for an extended agent to return an error when the agent, the associated job stream (XAJS), or the jobs were defined within a folder structure. |
| IJ46757 -WAO-I-417 | The twsinst command does not check for sufficient disk space for STDLIT copy operation during upgrade.The twsinst command did not perform a sufficiently robust disk space check to account for temporary space required at installation or upgrade time, resulting in installation failure and loss of critical log files. |
| IJ46910 | Workstation list displays incorrect product version.A defect in the system's status reporting caused the workstation list command or interface to display an incorrect product version for installed agents. |
| IJ50859 | Dynamic agent process fails to start automatically after system reboot.A defect in the installation logic prevented the dynamic agent process from starting automatically following a system reboot when the agent was installed as a fault-tolerant agent using the twsinst command. |
| IJ53045 | Tablespace parameters are ignored when running the configureDb script on a Db2 database.Custom paths specified for tablespaces with the |
| IJ54217 | IBM i agent installation fails due to unexpected java -version output format.A defect in the agent installation script caused the procedure to fail on IBM i environments because the script could not correctly parse the output of the java -version command. |
| IJ55550 | During the upgrade, he twsinst script with the recovInstReg parameter enabled fails with error code 5.A defect in the twsinst script caused the registry recovery operation (-recovInstReg true) to fail and return error code 5. When attempting to restore corrupted registry files, the twsinst script triggered an incorrect subroutine, resulting in the misleading error: "ERROR: TWS instance to enable for Cluster Installation is not a8.6.x.x/9.1.x.x version. Therefore no action will be performed." |
| IJ55711 | Agent upgrade fails due to unsupported OpenSSL encryption algorithm, specifically RC2-40-CBC algorithm.A defect in the agent upgrade process caused the installation to fail when attempting to process the P12 certificate file. The failure occurred because the bundled OpenSSL utility available on the agent encountered an unsupported encryption algorithm during the processing of the certificate file. |
| IJ55738 | Uninstall fails to clean up non-root installation files. A defect in the uninstallation procedure caused the system to leave the $HOME/.cit/cit.ini file in place following the uninstallation of a non-root instance.The uninstallation procedure failed to remove the cit.ini file after the uninstallation of a non-root instance. This configuration file retained an incorrect path to the common inventory technology (CIT) component, leading to configuration errors. |
| IJ56396 - KB0124632 | A master domain manager at version 10.2.5 experienced an unexpected service interruption caused by Java heap memory exhaustion.This issue typically occurred when a high number of dynamic agents were configured in the environment. The root cause was linked to the exhaustion of available HTTP connections. |
| KB0095841 | Agent update completed successfully despite critical disk space failure.The upgrade of dynamic agents erroneously reported successful completion with message AWSFAB033I, even when the installation process failed due to critical disk space issues. |
| KB0121428 | After installing a dynamic agent at version 10.2.4 on Windows and while running integrations, javaexecutor logs are missing.After installing or updating a dynamic agent on Windows, the required directory for Java logs was not created, causing the loss of JavaExecutor logs. |
| KB0122083 | Missing dbsslconnection parameter in installation scripts.The –dbsslconnection parameter in the configuredb or serverinst commands was available only on UNIX operating systems. |
| KB0122703 | Parallel upgrade fails with error AWKCLI102E due to an error in SSL password encryption.A defect caused the installation of the backup master domain manager to fail during a parallel upgrade, returning the AWKCLI102E error. The underlying cause was a bug in the code which failed during the encryption of the password when the password string length was exactly 16 characters or a multiple of 16 (for example 32, 48). |
| Code | Description |
|---|---|
| IJ50033 | conman display sched command fails to display job stream when extended agent is installed in a folder.A defect in the conman display sched command prevented locating or displaying a job stream when its assigned extended agent was defined within a folder structure. |
| IJ55742 | Unable to access composer in master domain manager after a password change when localopts encryption is disabled.A defect caused administrators to lose access to the composer utility on the master domain manager (MDM) following a password change, specifically when the localopts file encryption was disabled. |
| IJ56360 | A file dependency on a fault-tolerant agent installed on a Windows operating system fails after upgrading to version 10.2.3.A defect was introduced during the upgrade of the fault-tolerant agent installed on a Windows operating system, which caused file dependencies to fail resolution. The issue occurred on Windows Server 2016 when jobs defined to run on a dynamic pool utilized a file dependency pointing to a shared file system (UNC path). The internal file check mechanism erroneously failed to verify the existence of files, resulting in the unwanted nF (No File) status. |
| KB0117467 | The wa_pull_info command, also referred to as datagather command, generates an output file that file that may grow excessively, which can lead to significant consumption of disk space.The defect was related to a wrong location of the BMevent.conf file. In addition, the wa_pull_info command incorrectly collected and duplicated data from its previous runs placed in sensitive directories. |
| KB0121685 | Excessive conman entries logged in twsmerge.log file.A defect in the logging configuration causes the system to generate an excessive volume of detailed conman entries in the |
| KB0123031 | OUTPUTCOND keyword was replaced with SUCCOUTPUTCOND during OCLI modification.A defect in the scheduling object modification logic caused the OUTPUTCOND keyword to be erroneously replaced by the SUCCOUTPUTCOND keyword when an administrator used the OCLI (modify or add) commands. |
| KB0123997 | CONSLOG file not deleted by JnextPlan and plan management scripts.A defect prevents plan management scripts (including JnextPlan, MakePlan, SwitchPlan, UpdateStats, and CreatePostReports) from correctly deleting the |
| Code | Description |
|---|---|
| IJ55319 | Integration JAR file disappears after container reboot in Kubernetes environment.A defect in the Kubernetes deployment package caused integration JAR files to be deleted from the master domain manager container whenever the container was rebooted. |
| KB0106108 | Pod fails to start with mount error after enabling BMEvents logging.A defect in the cloud deployment configuration caused the master domain manager pod to fail initialization and crash with a mount error after the administrator enabled BmEvents logging. The issue was created because the deployment setup attempted to mount the BmEvents.conf file into the container volume path as if it were a directory. |
| Code | Description |
|---|---|
| IJ54942 | Jobs duplicated on dynamic agents because of delays in locking resources.A defect in the dynamic agent logic caused job duplication when a prolonged contention for an operating system resource lock occurred. The agent thread attempted to acquire a necessary lock and was forced to wait for an extended period. Because the dynamic domain manager default timeout for agent feedback was shorter, the dynamic domain manager prematurely assumed the initial job submission failed. Consequently, the dynamic domain manager submitted the identical job to a different dynamic agent within the pool. When the first job finally acquired the lock, it continued and completed, resulting in the same job executing simultaneously on two separate agents. |
| IJ56028 | Security scan on broker ports leading to performance issues.A security scan performed against the IBM Workload Scheduler broker port could cause numerous network connections to remain in a CLOSE_WAIT state, leading to the depletion of system resources (such as file descriptors and memory). |
| Code | Description |
|---|---|
| IJ55420 | REST API returns AWSJDB101E error due to JCL content.A defect in the REST API processing logic caused the API call to fail and return the following error |
| Code | Description |
|---|---|
| IJ56532 | SAP jobs fail due to R/3 password decryption error when password ends with "==" characters.A defect caused SAP jobs to fail with decryption and connection errors after upgrading the master domain manager and Dynamic Workload Console to version 10.2.5. The failure occurred specifically when the SAP password ended with the sequence of double equals signs (==), which is commonly found at the end of base64-encoded strings. The r3batch code failed to correctly read or decrypt the password string when it contained this ending sequence, resulting in connection failure and errors such as EEWO0020E ("An internal error occurred while trying to decrypt the R/3 password") and EEWO0124E ("The following SAP R/3 system... is not running"). |
| Code | Description |
|---|---|
| KB0102623 | REST API query returns no records when plan filter is used and security check is enabled.A defect introduced with REST API 2.0 caused queries utilizing the plan filter parameter to fail, incorrectly returning "0 records". This failure occurred specifically when the enListSecChk global option was set to YES on the master domain manager. |
| KB0110550 | REST API V2 submit ad hoc swagger body lacks mandatory task field example.The documentation for the REST API V2 used to submit an ad-hoc job via the swagger interface lacks a crucial example for the |
| KB0123280 | REST API V2 returns duplicate keys for dependencyType in plan job output.A defect in the REST API V2 interface caused the plan job output to contain duplicate key names for the dependencyType field within the dependencies array. |
| Code | Description |
|---|---|
| IJ53045 | Information needed about custom paths specified for tablespaces.Custom paths specified for tablespaces using the |
| IJ53654 | Incorrect statement in the documentation about Dynamic Workload Console database table reorganization.The database administrator must be informed about reorganizing the tables. |
| IJ53854 | The documentation for configuring Prometheus metric using the prometheus.xml file incorrectly specified the use of CDI-1.2 with IBM Workload Scheduler 10.1 FP5.This version incompatibility caused metrics to fail to be exposed in affected environments. Need to correct this configuration error. In subsequent releases, the prometheus.xml file has been removed and the metrics configuration procedure is automated. |
| IJ54592 | The product documentation for installation lacked explicit details on the password policy requirements, specifically failing to define the supported special characters and the maximum character length.Need to clearly specify the password constraints for installation, where enforced in the product. This includes a list of all supported special characters that can be utilized in administrator and system passwords. |
| IJ54656 | The documentation for the BmEvents.conf configuration file incorrectly lists Event ID 102 as the required identifier for failed job events.Need to list the correct value. The configuration details for failed job events in the BmEvents.conf file should specify Event ID 111, replacing the previous, erroneous listing of Event ID 102. |
| IJ55084 | Different event ids for failed job events on Windows and Linux.The system generates platform-specific Event IDs for failed job events, which is the expected and intended behavior but requires clarification in the documentation to avoid user confusion. |
| IJ55413 | Improve the examples in the documentation of the absolute interval time dependency.Need to improve the Examples section within the absolute interval time dependency documentation to provide clearer, more comprehensive, and current usage scenarios for scheduling constraints. |
| IJ55624 | Typographical error in the name of the |
| IJ55625 | Duplicate entry for the |
| IJ55739 | Need to create converting custom certificates documentation in the Upgrade documentation.The "Converting default certificates" documentation does not include the case for which custom certificates had been implemented. The documentation is adequate if the default certificates are the old, self-signed certificates that were formerly packaged with the product. |
| KB0122668 | In the documentation for the SSM agent, need to explicitly document the full path locations of the SSM log files across different operating systems.Need to clarify the SSM agent documentation to include the two distinct agents: one for the fault-tolerant agent and one for the dynamic agent, including details on their specific deployment and function. |
| KB0122774 | JobManager CPU excessive usage (100%) while submitting restful jobs.A defect caused the JobManager CPU utilization to increase usage to 100% when submitting RESTful jobs. This excessive CPU usage resulted in performance degradation. |
| KB0123694 | Documentation about SAP jobs failing on extended agent due to file permission error.Need to update the doc with information about best practices for job security and stability. |
Resolved Common Vulnerabilities and Exposures (CVEs)
The following CVEs have been resolved:
| CVE ID | Severity |
|---|---|
| CVE-2025-6965 | Major |
| CVE-2025-40778 | Major |
| CVE-2025-40780 | Major |
| CVE-2025-47906 | Major |
| CVE-2025-47907 | Major |
| CVE-2025-47912 | Major |
| CVE-2025-55163 | Major |
| CVE-2025-58183 | Major |
| CVE-2025-58185 | Major |
| CVE-2025-58186 | Major |
| CVE-2025-58187 | Major |
| CVE-2025-58188 | Major |
| CVE-2025-58189 | Major |
| CVE-2025-61723 | Major |
| CVE-2025-61724 | Major |
| CVE-2025-61725 | Major |
| CVE-2025-5187 | Normal |
| CVE-2025-5318 | Normal |
| CVE-2025-9714 | Normal |
| CVE-2025-11965 | Normal |
| CVE-2025-47914 | Normal |
| CVE-2025-53905 | Normal |
| CVE-2025-53906 | Normal |
| CVE-2025-58181 | Normal |
| CVE-2025-61727 | Normal |
| CVE-2025-61729 | Normal |
| CVE-2025-7962 | Normal |
| CVE-2025-8058 | Normal |
Interoperability tables
In the tables in this section the following acronyms are used:
| Acronym | Extended form |
|---|---|
| DA | Dynamic agent |
| DDM | dynamic domain manager or backup dynamic domain manager |
| DM | domain manager |
| DWC | Dynamic Workload Console |
| FTA | fault-tolerant agent |
| MDM | master domain manager |
| BKM | backup master domain manager |
| ZWS agent | IBM Z Workload Scheduler Agent |
Compatibility is supported on the latest available release level for each IBM Workload Scheduler release listed in the table:
| Component | MDM | DDM | DM | FTA | DA | ZWS agent |
|---|---|---|---|---|---|---|
| MDM 10.2.6 |
|
|
|
|
| |
| DM 10.2.6 |
|
| ||||
| FTA 10.2.6 |
|
|
| |||
| DA 10.2.6 |
|
|
| |||
| DDM 10.2.6 |
|
|
|
| Component | MDM | DDM | DWC |
|---|---|---|---|
| AIDA 10.2.6 | 10.x.x | 10.x.x | 10.x.x |
Compatibility scenarios and limitations
It is highly recommended to keep all IBM Workload Scheduler components updated to the latest version as part of regular maintenance. This not only maintains a consistent environment but also enables you to utilize new features introduced in each release.
Known limitations and workarounds
The following are software limitations and workarounds that affect IBM Workload Scheduler 10.2.6:
Certificate rotation not working properly on agents
Ensure you install the packages for APAR IJ57691 before installing or upgrading. This fix ensures automatic certificate rotation works correctly on 10.2.6 agents and is available on IBM Fix Central. For the detailed procedure to apply the workaround, see IJ57691 Automatic download of certificates will loop on Agent 10.2.6.
Mixed-version environment with a master domain manager at a version earlier than 9.5 FP4
Before you install a component at version 10.2.6 in an environment with a master domain manager at a version earlier than 9.5 FP4, install the fix for IJ47731 on the back-level master domain manager.
- For version 9.4 FP7, the fix is available from IBM Fix Central.
- For other product versions, contact Software Support.
Event-driven workload automation (EDWA) proxy does not support HTTPS connections
Event-driven workload automation (EDWA) proxy supports only HTTP connections. As a result, SSL communication is not supported.
Linking a fault-tolerant agent earlier than 10.2 in an environment configured with certificates
If you link a fault-tolerant agent earlier than V10.2 to an environment with a master domain manager at version 10.2.1 or later using certificates, you need to manually install the certificates on the fault-tolerant agent. To perform the manual installation, you can follow the steps below:
- Shut down the workstation of the fault-tolerant agent
- Create a backup of the localopts file
- Create a new folder under the target fault-tolerant agent as in the following example: <TWS_DATA_DIR>/<new_cert_folder>
- From the master domain manager, copy the files under TWA_DATA_DIR/ssl/depot
- Paste the TWA_DATA_DIR/ssl/depot files from the master domain manager into the <TWS_DATA_DIR>/<new_cert_folder> new directory
- Update the localopts file of the fault-tolerant agent by changing the values of the following properties:
- SSL Key: <TWS_DATA_DIR>/<new_cert_folder>/tls.key
- SSL Certificate: <TWS_DATA_DIR>/<new_cert_folder>/tls.crt
- SSL key pwd: <TWS_DATA_DIR>/<new_cert_folder>/tls.sth
- SSL CA certificate: <TWS_DATA_DIR>/<new_cert_folder>/ca.crt
- Turn on the workstation of the fault-tolerant agent.
The centralized update on a stand-alone fault-tolerant agent V10.2.1 is not supported
The centralized update on a fault-tolerant agent V10.2.1 is not supported, regardless of the operating system. For more information about upgrading from different versions, see Performing the centralized agent update on a stand-alone fault-tolerant agent.
ITLM tool incorrectly discovering z-centric agents
After installing a dynamic agent, the ITLM tool might incorrectly discover a z-centric agent. You can find two possible reasons and their workarounds below:
The directory in which you temporary unzipped package images contains a wrong tag
If you did not delete the temporary directory, delete the following file:
The directory in which you installed the package contains a wrong tag
To avoid the issue, delete the
ibm.com_IBM_Z_Workload_Scheduler_Agent-9.5.0.swidtagfile from the following path:
Pool connection issues with CyberArk
If you are using a pool as a gateway to communicate with CyberArk and an agent within the pool loses connection to the CyberArk server, the job assigned to that specific agent fails. For instance, if an agent remains up and running but stops communicating with CyberArk, any jobs assigned to that agent that require a connection to CyberArk fails. This occurs because the pool lacks the ability to verify whether its agents are connected to the CyberArk server.
Folder filtering discrepancy in Command Line Interfaces
Filtering for jobs and job streams within folders with Orchestration CLI or REST APIs V2 using
conmansyntax might not work as expected, returning different results from the ones retrieved usingconman.Japanese characters might display incorrectly in job logs on Windows for Dynamic Workload Console and fault-tolerant agents
Job logs containing Japanese characters might appear garbled when viewed in the Dynamic Workload Console or when using the command line on fault-tolerant agents running on Windows operating systems.
Resource CLI commands not supported on Windows workstations
Resource CLI commands are currently not supported on Windows workstations.
The diagnostic tool wa_pull_info is not producing any output on Windows operating systems
When you launch the wa_pull_info command on Windows operating systems, the command ends without producing the expected .zip file in the default folder.
Unresolved dependency state with shadow jobs and start of day setting
Successor jobs remain permanently in the HOLD state, even after the shadow job predecessors successfully complete. This happens specifically when the job stream execution crosses the customized Start of Day boundary due to the job rerun logic. The product correctly updates the final status of the shadow job to SUCC, but the dependency is not released when the related scheduling event occurs close to or across the
startOfDay. The job is effectively orphaned in the queue, stuck in HOLD despite having met its only prerequisite.ABENDPROMPT Failure to Suppress RERUN on AIX operating systems
On AIX operating systems, the presence of an
ABENDPROMPTsetting fails to correctly block the automatic execution of theRECOVERY RERUNaction when a job terminates in the ABEND state.The job manager fails to prioritize the prompt mechanism, which should transition the job to a waiting state and generate an immediate
ASKEDprompt, thereby overriding or delaying the automaticRERUNdefined in the recovery policy.This failure results in an uncontrolled automatic rerun, bypassing the required human intervention point defined by the
ABENDPROMPTsetting.Certificate expiration date is not visible for dynamic agents connecting to dynamic domain managers
The certificate expiration date is not visible when a dynamic agent connects to a dynamic domain manager.
Database support for dynamic domain managers
The installation and operation of dynamic domain managers are exclusively supported with Db2, Oracle, and MSSQL databases. The PostgreSQL database is currently not supported for use with dynamic domain managers.
Certificate management for agents on IBM i
When installing dynamic agents on IBM i, ensure the required certificate files are available on the agent and use only the sslkeysfolder and sslpassword parameters to configure them. Downloading certificates using the wauser and wapassword parameters is not supported.
Package structure
For a detailed list of available packages, see the 10.2.6 Quick Start Guide document available from IBM Fix Central.
Software requirements for WebSphere Application Server Liberty Base
WebSphere Application Server Liberty Base adopts a continuous delivery model where new versions are deployed on a monthly basis.
During formal testing, IBM Workload Scheduler and the Dynamic Workload Console were tested using WebSphere Application Server Liberty Base version 25.0.0.11. The minimum required version to successfully install the product is 25.0.0.9
For the Dynamic Workload Console installed in a z/OS environment, testing was conducted using WebSphere Application Server Liberty Base version 25.0.0.9, which is also the minimum required version for that configuration.
For more information about which subsequent versions of WebSphere Application Server Liberty Base can be used in the future, see Recommended updates for WebSphere Application Server.
Installing and upgrading to version 10.2.6
This section describes how to install or upgrade to version 10.2.6.
Before installing the release, ensure you have installed the required prerequisite software. To obtain the latest information about system requirements, run the Detailed System Requirements report and browse to the relevant section.
Installation notes
- If you plan to perform a fresh installation with WebSphere Application Server Liberty 26.0.0.3 or later, set the SECUREWRAP_PASSPHRASE environment variable to a custom passphrase of your choice before you run the installation command. If you are upgrading IBM Workload Scheduler or WebSphere Application Server Liberty, no action is required. For more information, see IWS 10.2.x earlier than 10.2.7 returns installation failure with Liberty 26.0.0.3.
Before performing an upgrade, check whether the ssl_config.xml file is present in the overrides folder. If the file is present, check the verifyHostname option in the twaSSLSettings section. The verifyHostname must be set to false, as shown in the following example:
<ssl id="twaSSLSettings" keyStoreRef="twaKeyStore" trustStoreRef="twaTrustStore" sslProtocol="TLSv1.2" clientAuthenticationSupported="true" verifyHostname="false"/>- Depending on the WebSphere Application Server Liberty version you are using, you might encounter the problems described in the following technotes:
Versions equal to or higher than 24.0.0.8
See Possible IWS compatibility issues with Liberty 24.0.0.8 or higher
Versions ranging from 24.0.0.3 to 24.0.0.8
Upgrade notes
If you are using MSSQL and are upgrading from a release earlier than 10.2.3, perform the steps listed below after upgrading to version 10.2.6. If you are using MSSQL and are upgrading from release 10.2.3 or a release later than 10.2.3, you can ignore the steps listed below.
- Browse to the datasource.xml template.
- Open the file with a text editor and perform the following changes:
Add the lines listed below after the db.driver.path parameter:
<variable name="db.encrypt" value="false"/> <variable name="db.trustServerCertificate" value="false"/>Append the following strings at the end of the value of the mssql.URL parameter:
;encrypt=${db.encrypt};trustServerCertificate=${db.trustServerCertificate}Add the lines listed below after the integratedSecurity parameter:
encrypt="${db.encrypt}" trustServerCertificate="${db.trustServerCertificate}"The resulting file looks as follows. The modified sections are highlighted in bold:
... <variable name="db.driver.path" value="<db_driver_path>"/> <variable name="db.encrypt" value="false"/> <variable name="db.trustServerCertificate" value="false"/> <variable name="mssql.URL" value="jdbc:sqlserver://${db.serverName}:${db.portNumber};databaseName=${db.databaseName} ;encrypt=${db.encrypt};trustServerCertificate=${db.trustServerCertificate}"/> <jndiEntry value="MSSQL" jndiName="db.type" /> ... integratedSecurity="false" encrypt="${db.encrypt}" trustServerCertificate="${db.trustServerCertificate}"
- Stop and restart WebSphere Application Server Liberty to make the changes effective.
When upgrading to Dynamic Workload Console version 1025, if the previous environment is configured for Single Sign-On (SSO) using ltpa.keys, perform the following steps:
- copy the
ltpa.keysfile either from the master domain manager to the workstation hosting the Dynamic Workload Console, or vice versa, depending on your configuration. - After copying, restart the IBM Workload Scheduler processes on the component where the
ltpa.keysfile was updated to complete the SSO setup.
Installation and upgrade procedures
You can install the release using the procedure described in Installing from the CLI.
You can upgrade to the current release using the procedure described in Upgrading from the CLI.
Disk space requirements
To obtain the latest information about permanent disk space requirements when installing on supported operating systems, run the Hardware requirements report and click on the relevant operating system link.
Performing the centralized agent update on a stand-alone fault-tolerant agent
Before performing a centralized update on fix packs or upgrade on releases on a stand-alone fault-tolerant agent to 10.2.6, there are procedures to follow according to the version of the fault-tolerant agent from which you want to upgrade.
The table below shows which procedure you must follow to perform the upgrade, according to the fault-tolerant agent version.
| Stand-alone fault-tolerant agent version | Required steps |
|---|---|
| V9.5 Fix Pack 4 up to V9.5 Fix Pack 6 | If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description |
| V9.5 Fix Pack 7 | No steps required. |
| V10.1 up to V10.1 Fix Pack 3 | If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description. Then, from the same workstation where the fault-tolerant agent is installed, copy the TWSClientKeyStore files from TWA_DATA_DIR/ssl/GSKit to TWA_DATA_DIR/ITA/cpa/ita/cert. Note: The owner of the new TWSClientKeyStore files and the permissions granted must be the same of the existing files. |
| V10.1 Fix Pack 4 | If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description. Then, download the curl file from APAR IJ50967 and save it inside TWS/ITA/cpa/ita. Note: The owner of the new curl file and the permissions granted must be the same of the existing curl file. |
| V10.2 | If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description. Then, download the curl file from APAR IJ50967 and save it inside TWS/ITA/cpa/ita. Note: The owner of the new curl file and the permissions granted must be the same of the existing curl file. |
| V10.2.1 | Not supported. |
| V10.2.2 and later | No additional procedure required. |
Documentation updates
Any additions or changes to the documentation as a result of this release have been integrated into the online product documentation available in IBM Workload Scheduler product information.
Contacting IBM Workload Scheduler Software Support
Before contacting IBM Software Support with a problem, refer to the IBM Software Support site by accessing the following Web address: https://www.ibm.com/support/home/
To access IBM support, click the IBM support link at the bottom right of the page.
If you want to contact IBM Software Support, see the IBM Software Support Handbook at the following Web site: http://techsupport.services.ibm.com/guides/handbook.html
The guide provides information about how to contact IBM Software Support, depending on the severity of your problem, and the following information:
- Registration and eligibility.
- Telephone numbers, depending on the country in which you are located.
- Information you must have before contacting IBM Software Support.
Notices
This information was developed for products and services offered in the US. This material might be available from IBM Workload Scheduler in other languages. However, you may be required to own a copy of the product or product version in that language in order to access it.
IBM Workload Scheduler may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM Workload Scheduler representative for information on the products and services currently available in your area. Any reference to an IBM Workload Scheduler product, program, or service is not intended to state or imply that only that IBM Workload Scheduler product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM Workload Scheduler intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM Workload Scheduler product, program, or service.
IBM Workload Scheduler may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
US
For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Workload Scheduler Intellectual Property Department in your country or send inquiries, in writing, to:
Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM Workload Scheduler may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.
Any references in this information to non-IBM Workload Scheduler websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM Workload Scheduler product and use of those websites is at your own risk.
IBM Workload Scheduler may use or distribute any of the information you provide in any way it believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:
IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
US
Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.
The licensed program described in this document and all licensed material available for it are provided by IBM Workload Scheduler under terms of the IBM Workload Scheduler Customer Agreement, IBM Workload Scheduler International Program License Agreement or any equivalent agreement between us.
The performance data discussed herein is presented as derived under specific operating conditions. Actual results may vary.
Information concerning non-IBM Workload Scheduler products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM Workload Scheduler has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM Workload Scheduler products. Questions on the capabilities of non-IBM Workload Scheduler products should be addressed to the suppliers of those products.
This information is for planning purposes only. The information herein is subject to change before the products described become available.
This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to actual people or business enterprises is entirely coincidental.
COPYRIGHT LICENSE:
This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM Workload Scheduler, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM Workload Scheduler, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM Workload Scheduler shall not be liable for any damages arising out of your use of the sample programs.
© IBM Workload
Scheduler 2006, 2016. All rights reserved. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
© Copyright HCL Technologies Limited 2016, 2025.
Portions of this code are derived from IBM Workload Scheduler Sample Programs.
Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Adobe™, the Adobe logo, PostScript™, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries.
IT Infrastructure Library™ is a Registered Trade Mark of AXELOS Limited.
Linear Tape-Open™, LTO™, the LTO Logo, Ultrium™, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.
Intel™, Intel logo, Intel Inside™, Intel Inside logo, Intel Centrino™, Intel Centrino logo, Celeron™, Intel Xeon™, Intel SpeedStep™, Itanium™, and Pentium™ are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.
Linux™ is a registered trademark of Linus Torvalds in the United States, other countries, or both.
Microsoft™, Windows™, Windows NT™, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.
![]() | Java™ and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. |
Cell Broadband Engine™ is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom.
ITIL™ is a Registered Trade Mark of AXELOS Limited.
UNIX™ is a registered trademark of The Open Group in the United States and other countries.
Terms and conditions for product documentation
Permissions for the use of these publications are granted subject to the following terms and conditions.
Applicability
These terms and conditions are in addition to any terms of use for the IBM Workload Scheduler website.
Personal use
You may reproduce these publications for your personal, noncommercial use provided that all proprietary notices are preserved. You may not distribute, display or make derivative work of these publications, or any portion thereof, without the express consent of IBM Workload Scheduler.
Commercial use
You may reproduce, distribute and display these publications solely within your enterprise provided that all proprietary notices are preserved. You may not make derivative works of these publications, or reproduce, distribute or display these publications or any portion thereof outside your enterprise, without the express consent of IBM Workload Scheduler.
Rights
Except as expressly granted in this permission, no other permissions, licenses or rights are granted, either express or implied, to the publications or any information, data, software or other intellectual property contained therein.
IBM Workload Scheduler reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use of the publications is detrimental to its interest or, as determined by IBM Workload Scheduler, the above instructions are not being properly followed.
You may not download, export or re-export this information except in full compliance with all applicable laws and regulations, including all United States export laws and regulations.
IBM Workload Scheduler MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS ARE PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.
Was this topic helpful?
Document Information
Modified date:
04 May 2026
UID
ibm17249253
