IBM Support

Release Notes for IBM Workload Scheduler 10.2.6

Release Notes


Abstract

This document provides important information about IBM Workload Scheduler Version 10.2.6

Content

IBM Workload Scheduler version 10.2.6 Release Notes

Release date: 2025, December 15

This document provides important information about IBM® Workload Scheduler version 10.2.6.

You can obtain dynamic and up-to-date reports by browsing to Software Product Compatibility Reports and selecting the information you are interested in.

Features introduced with version 10.2.6

Helpful videos demonstrating new features are available on Workload Automation YouTube channel.

Important information for version 10.2.6

Starting with IBM Workload Scheduler version 10.2.6, the Workload Definitions section for version 9.x connected engines will be removed from the Dynamic Workload Console. Therefore, the following pages will no longer be available:

  • Manage Workload Definitions
  • List Workload Definitions
  • Import Workload Application
  • Manage Event Rules
  • Create Workstations
  • List Workstations

APARs fixed in version 10.2.6

Table 1. Engine component - APARs fixed in this release
CodeDescription
IJ12526
Duplicate job stream entries were erroneously generated and added to the plan following the execution of the JnextPlan command, leading to potential confusion and operational issues.

This defect manifests particularly with hourly recurring job streams defined to run throughout the day (e.g., EVERY 0100), even when the STARTOFDAY (SD) global option is set to midnight (0000).

IJ35898
Misleading error message when deleting a resource sharing the same name as an existing resource defined on a different workstation.

An incorrect error message was displayed when an administrator attempted to delete a resource object that shared the same name as another resource but was defined on a different workstation.

IJ48015
Unable to view or edit dynamic domain manager pool workstations after upgrading to version 10.1.

A defect prevented administrators from successfully viewing or editing dynamic domain manager pool workstations after upgrading the environment to version 10.1.

IJ48789
Agents are not sending job status to the master domain manager

A defect in the job management mechanism caused agents not to send job status updates to the master domain manager. This failure resulted in the continuous increase in size of the job table directory because completed job files were not properly cleaned up or communicated to the master domain manager.

IJ50063
Recovery jobs have incorrect job names in conamn showjob in stdlist format.

A defect in the plan status reporting caused the conamn showjob command to display an incorrect job name for recovery jobs. When you used the command to retrieve the standard list (stdlist) output for a job stream containing a recovery job, the output incorrectly referenced the original job name instead of the system-generated recovery job name.

IJ50624
JSON Web Tokens (JWT) are not renewed when certificates are rotated on the master domain manager.

A defect in the security mechanism caused JWT to fail renewal following the successful rotation of SSL certificates on the master domain manager.

IJ51132
The security token cannot be validated message in trace.log.

A configuration issue or defect causes the application server to fail to validate security tokens, leading to recurring CWWKS4001I error messages being written to the trace.log file.

IJ51210
rmstdlist script failing to delete non-empty directories.

A defect in the RMSTDLIST utility script prevents the successful deletion of old directories within the stdlist structure when using the modern find ... -delete command syntax.

IJ51847
The server.xml file uses hard-coded key alias instead of the relevant variable retrieved from the jwt_variables.xml file.

A defect in the master domain manager configuration caused the server.xml file to use a hard-coded reference for the key alias within its security configuration.

IJ53156
Vulnerability in LIBCURL (CVE-2024-7264).

Need to fix vulnerability CVE-2024-7264.

IJ53898
Dynamic agent unlinking due to Java heap space consumption.

Dynamic agents encountered frequent Java Heap Space exhaustion, leading to the agent repeatedly unlinking from the master domain manager. Increasing available memory did not solve the issue. Memory consumption issue was tied specifically to the RESTful plugin.

IJ53988
The backup master domain manager stops working due to low memory and database connection deadlock.

A timing-dependent defect caused the backup master domain manager to stop responding. The issue is due to a timing conflict within the database connection pooling logic, where a request for a new connection clashed with an existing connection attempting to access a configuration file.

IJ54174
Unable to change user password in the plan if the password contains a backslash character.

A defect prevents users from successfully changing their password using the alter user password in plan function when the new password string includes the backslash character.

IJ54208
Rerun job log differs from initial job run log

The job log generated after rerunning a job was different from the job log generated when running the same job for the first time.

IJ54326
Memory consumption increase in master domain manager.

A defect in the scheduling engine caused the memory utilization on the master domain manager to continually increase. The Java process was unable to release memory resources effectively, leading to a progressive memory leak or inefficient resource management.

IJ54823 - KB0121311
File transfer job integration fails with null pointer exception when processing a high number of files.

A critical defect in the File Transfer integration caused the job to fail with a Null Pointer Exception (NPE) when processing a large number of files. The underlying file management code experienced a logic failure when handling the resource list, which led to the NPE and prematurely terminated the file transfer job, preventing the completion of bulk transfer tasks.

IJ54937
When setting an incorrect frequency for the movehistorydata command, the resulting system message was misleading. The message erroneously stated that the command operational frequency was set to 60 minutes, when the true system default is 5 minutes.

When an incorrect value was set, the system incorrectly ran the utility every 5 minutes, rather than reverting to the default frequency of 60 minutes, as stated in the message. This discrepancy between the expected default and the actual operational behavior created unforeseen system load and potential performance risks.

IJ55004
Jobs completing in error due to read-only user home directory.

A product defect caused job execution to fail with EXIT STATUS: 127 and the following error "script.sh: Text file busy" when attempting to run a job. This problem occurred specifically on environments where the user HOME directory was configured on a read-only file system.

IJ55087
Multiple job streams with rerun cause high CFJOB messages.

A performance defect causes the intercom.msg file to grow excessively with CFJOB (Carried Forward Job) messages when multiple job streams containing rerun logic are carried forward across the plan end time.

IJ55241 - KB0122349
WebSphere Application Server Liberty crashes frequently generating JavaCore dump files.

A product defect caused WebSphere Application Server Liberty to crash frequently, resulting in the generation of JavaCore dump files. This instability occurred when the server invoked the native library LIBTWSPLANJNI.SO (Java Native Interface), indicating an issue within the JNI layer during plan-related operations.

IJ55288
When creating a new security domain with Security object type USEROBJ, it is impossible to set the CPU and CPUFOLDER attributes.

A defect in the object handling logic caused the CPUFOLDER attribute to be erroneously deleted or ignored from the USEROBJ security object definition after modification using the composer mod sdom command. When administrators explicitly included CPUFOLDER in the USEROBJ instruction, the attribute was not maintained when editing or saving the security domain.

IJ55357
Need to address a number of vulnerabilities in Apache Commons.

Vulnerabilities to be addressed: CVEs: CVE-2025-48795, CVE-2025-48924, CVE-2025-4892, CVE-2012-5783

IJ55366
Folder path separator removed from recovery job names.

A defect in the code causes the folder path separator character (the forward slash, /) to be incorrectly removed from the job name and workstation name of a recovery job when its properties are viewed.

IJ55398
The SwitchPlan script completes in error due to a memory fault when stopping a fault-tolerant agent defined in a folder.

The issue occurred while running the conman stop @!/@/@;wait;noask command, which uses a wildcard to target all workstations, including those defined in folders. The code failed to properly handle the memory allocation when processing the large, complex list of folder-based workstation names generated by the wildcard, leading to the memory fault.

IJ55401
optman option enDbGetOpsAudit not working, impacting performance of composer tasks.

A defect in the audit logging mechanism caused the optman option enDbGetOpsAudit (dg) to stop working in version 10.2.2, leading to severe performance degradation. This option, intended to suppress the logging of routine database GET operations, was ignored even when set to 0. Consequently, every database retrieval action was logged to the audit JSON file, which significantly increased the execution time of composer procedures.

IJ55702
Job stream instances scheduled after 12 AM fail to load into the plan when the STARTOFDAY global option was configured to a time other than 12 AM.

A defect in the plan generation logic caused job stream instances scheduled with hourly recurrence to fail to load into the current plan for times occurring after the midnight boundary (12 AM).

IJ55718
Dynamic agents installed on AIX randomly crash. This instability occurred across multiple releases.

The crash resulted in the generation of core files at the agent level, forcing the affected agents offline and disrupting scheduling operations. The issue suggested a recurrent internal stability problem specific to the AIX environment within the dynamic agent process.

IJ55842
The planman resync command takes excessive time after SwitchPlan command.

A defect in the plan synchronization mechanism caused the planman resync operation, specifically following a SwitchPlan command, to randomly take an excessive amount of time to complete, significantly exceeding standard behavior.

IJ56306
The agent for z/OS (also known as d-driven agent) cannot connect to the dynamic domain manager (also known as broker server) version 10.2.4 and returns error EELHT15E.

A defect in the communication protocol caused the agent for z/OS to fail when attempting to connect to a dynamic domain manager at version 10.2.4. The connection failure was indicated in the agent log by the message EELHT15E, followed by the response code REST_SERVICE_FAILED (EELHT43I).

KB0121156
WebSphere Application Server Liberty restarts frequently when installed with IBM Workload Scheduler version 10.2.3.

A critical product defect caused the WebSphere Application Server Liberty on the master domain manager 10.2.3, Linux OS) to restart frequently, generating multiple Java core files with error AWSBDJ003E The application server has stopped unexpectedly or failed..

KB0122051
Agent using JWT unlinks after master domain manager certificate renewal.

A defect caused agents configured to use JSON Web Token (JWT) authentication to disconnect or unlink from the master domain manager following the rotation of SSL certificates rotation on the master domain manager.

KB0122821
A defect was identified in the cleanuserjobs.sh script that caused execution to fail when the environment utilized a PostgreSQL database.

A defect in the cleanuserjobs.sh script caused a failure with the database error AWKCLI102E when the environment utilized a PostgreSQL database.

KB0123037
jsuntil time not evaluated properly when the job stream uses a different time zone.

A defect in the scheduling logic caused the jsuntil time to be evaluated incorrectly when a job stream was defined with a time zone that differed from the system and CPU time zones.

KB0123390
IBM Workload Scheduler processes cause SYN flooding on Azure hosts.

A product defect caused SYN flooding to occur on Azure hosts running SLES 15 SP06 when the JobManagerGW and associated agent processes were actively running.

KB0123509
Errors returned when fetching large job logs.

A defect in the job log retrieval mechanism caused the system to return errors when attempting to view or fetch large job logs (observed for file sizes 1 MB or greater). This problem occurred specifically for native jobs, not Java jobs.

KB0123693
Job NOP/HOLD status modification failure due to Access Control List (ACL) restrictions: a defect in the ACL evaluation prevented users from modifying the No Operation (NOP) or HOLD status on job definitions when the modification initiated from the planning level.

The system erroneously required high-level design/model permissions (such as modify rights) to perform a simple operational status change, even when the user possessed the specific operational permissions.

KB0123694
SAP jobs fail on extended agent due to .sth file read permission error.

A defect introduced by the new 3DES to AES encryption mechanism caused SAP jobs running on an extended agent to fail with the error EEWO0012E (The extended agent could not be initialized).

KB0124564
RESTful API job with callback hangs due to backup master domain manager handling.

A recurring issue caused RESTful API type jobs configured with a callback feature to hang and never return a completion status after submission, specifically in complex environments utilizing a load balancer.

Table 2. Installation process – APARs fixed in this release
CodeDescription
IJ39603
Oracle SQL scripts fail during manual database configuration.

A defect in the database configuration utility, when generating manual SQL scripts for Oracle environments (using configureDb.sh -execsql false), caused the resulting scripts to return an error. The generated files contained formatting errors, including trailing backslashes ($\text{\}$) and missing semicolons on many lines, which Oracle SQL clients rejected.

IJ40294
z-centric agent skips systemd configuration during reinstallation on Red Hat Enterprise Linux (RHEL) 8.

A defect in the z-centric agent installer caused the systemd service configuration phase to be erroneously skipped during reinstallation on RHEL V8, leaving the reinstalled agent unable to start or manage processing.

IJ41121
DWCRest.war does not customize the database schema name.

A defect in the installation process prevents the Dynamic Workload Console (DWC) REST API component from correctly customizing the database schema name.

IJ41406
The twsinst generates false error during upgrade due to wrong SWIDTAG file reference.

A defect in the twsinst upgrade logic caused it to incorrectly search for the wrong Software ID (SWID) tag file during the upgrade of a dynamic agent.

IJ44938
Events on an extended agent fail when the agent is defined within a folder.

A defect in the event handling mechanism caused event rules configured for an extended agent to return an error when the agent, the associated job stream (XAJS), or the jobs were defined within a folder structure.

IJ46757 -WAO-I-417
The twsinst command does not check for sufficient disk space for STDLIT copy operation during upgrade.

The twsinst command did not perform a sufficiently robust disk space check to account for temporary space required at installation or upgrade time, resulting in installation failure and loss of critical log files.

IJ46910
Workstation list displays incorrect product version.

A defect in the system's status reporting caused the workstation list command or interface to display an incorrect product version for installed agents.

IJ50859
Dynamic agent process fails to start automatically after system reboot.

A defect in the installation logic prevented the dynamic agent process from starting automatically following a system reboot when the agent was installed as a fault-tolerant agent using the twsinst command.

IJ53045
Tablespace parameters are ignored when running the configureDb script on a Db2 database.

Custom paths specified for tablespaces with the --iwstspath, --iwslogtspath, and --iwsplantspath parameters are ignored. This happens because custom paths are not supported for Db2, Db2 for Z/OS, Informix, or Oracle. This problem is external to IBM Workload Scheduler and cannot be resolved within the product.

IJ54217
IBM i agent installation fails due to unexpected java -version output format.

A defect in the agent installation script caused the procedure to fail on IBM i environments because the script could not correctly parse the output of the java -version command.

IJ55550
During the upgrade, he twsinst script with the recovInstReg parameter enabled fails with error code 5.

A defect in the twsinst script caused the registry recovery operation (-recovInstReg true) to fail and return error code 5. When attempting to restore corrupted registry files, the twsinst script triggered an incorrect subroutine, resulting in the misleading error: "ERROR: TWS instance to enable for Cluster Installation is not a8.6.x.x/9.1.x.x version. Therefore no action will be performed."

IJ55711
Agent upgrade fails due to unsupported OpenSSL encryption algorithm, specifically RC2-40-CBC algorithm.

A defect in the agent upgrade process caused the installation to fail when attempting to process the P12 certificate file. The failure occurred because the bundled OpenSSL utility available on the agent encountered an unsupported encryption algorithm during the processing of the certificate file.

IJ55738
Uninstall fails to clean up non-root installation files. A defect in the uninstallation procedure caused the system to leave the $HOME/.cit/cit.ini file in place following the uninstallation of a non-root instance.

The uninstallation procedure failed to remove the cit.ini file after the uninstallation of a non-root instance. This configuration file retained an incorrect path to the common inventory technology (CIT) component, leading to configuration errors.

IJ56396 - KB0124632
A master domain manager at version 10.2.5 experienced an unexpected service interruption caused by Java heap memory exhaustion.

This issue typically occurred when a high number of dynamic agents were configured in the environment. The root cause was linked to the exhaustion of available HTTP connections.

KB0095841
Agent update completed successfully despite critical disk space failure.

The upgrade of dynamic agents erroneously reported successful completion with message AWSFAB033I, even when the installation process failed due to critical disk space issues.

KB0121428
After installing a dynamic agent at version 10.2.4 on Windows and while running integrations, javaexecutor logs are missing.

After installing or updating a dynamic agent on Windows, the required directory for Java logs was not created, causing the loss of JavaExecutor logs.

KB0122083
Missing dbsslconnection parameter in installation scripts.

The –dbsslconnection parameter in the configuredb or serverinst commands was available only on UNIX operating systems.

KB0122703
Parallel upgrade fails with error AWKCLI102E due to an error in SSL password encryption.

A defect caused the installation of the backup master domain manager to fail during a parallel upgrade, returning the AWKCLI102E error. The underlying cause was a bug in the code which failed during the encryption of the password when the password string length was exactly 16 characters or a multiple of 16 (for example 32, 48).

Table 3. Command-line component – APARs fixed in this release
CodeDescription
IJ50033
conman display sched command fails to display job stream when extended agent is installed in a folder.

A defect in the conman display sched command prevented locating or displaying a job stream when its assigned extended agent was defined within a folder structure.

IJ55742
Unable to access composer in master domain manager after a password change when localopts encryption is disabled.

A defect caused administrators to lose access to the composer utility on the master domain manager (MDM) following a password change, specifically when the localopts file encryption was disabled.

IJ56360
A file dependency on a fault-tolerant agent installed on a Windows operating system fails after upgrading to version 10.2.3.

A defect was introduced during the upgrade of the fault-tolerant agent installed on a Windows operating system, which caused file dependencies to fail resolution. The issue occurred on Windows Server 2016 when jobs defined to run on a dynamic pool utilized a file dependency pointing to a shared file system (UNC path). The internal file check mechanism erroneously failed to verify the existence of files, resulting in the unwanted nF (No File) status.

KB0117467
The wa_pull_info command, also referred to as datagather command, generates an output file that file that may grow excessively, which can lead to significant consumption of disk space.

The defect was related to a wrong location of the BMevent.conf file. In addition, the wa_pull_info command incorrectly collected and duplicated data from its previous runs placed in sensitive directories.

KB0121685
Excessive conman entries logged in twsmerge.log file.

A defect in the logging configuration causes the system to generate an excessive volume of detailed conman entries in the twsmerge.log file, even when the logging level is set to the default INFO level.

KB0123031
OUTPUTCOND keyword was replaced with SUCCOUTPUTCOND during OCLI modification.

A defect in the scheduling object modification logic caused the OUTPUTCOND keyword to be erroneously replaced by the SUCCOUTPUTCOND keyword when an administrator used the OCLI (modify or add) commands.

KB0123997
CONSLOG file not deleted by JnextPlan and plan management scripts.

A defect prevents plan management scripts (including JnextPlan, MakePlan, SwitchPlan, UpdateStats, and CreatePostReports) from correctly deleting the CONSLOG file.

Table 4. Docker – APARs fixed in this release
CodeDescription
IJ55319
Integration JAR file disappears after container reboot in Kubernetes environment.

A defect in the Kubernetes deployment package caused integration JAR files to be deleted from the master domain manager container whenever the container was rebooted.

KB0106108
Pod fails to start with mount error after enabling BMEvents logging.

A defect in the cloud deployment configuration caused the master domain manager pod to fail initialization and crash with a mount error after the administrator enabled BmEvents logging. The issue was created because the deployment setup attempted to mount the BmEvents.conf file into the container volume path as if it were a directory.

Table 5. dynamic domain manager (broker) – APARs fixed in this release
CodeDescription
IJ54942
Jobs duplicated on dynamic agents because of delays in locking resources.

A defect in the dynamic agent logic caused job duplication when a prolonged contention for an operating system resource lock occurred. The agent thread attempted to acquire a necessary lock and was forced to wait for an extended period. Because the dynamic domain manager default timeout for agent feedback was shorter, the dynamic domain manager prematurely assumed the initial job submission failed. Consequently, the dynamic domain manager submitted the identical job to a different dynamic agent within the pool. When the first job finally acquired the lock, it continued and completed, resulting in the same job executing simultaneously on two separate agents.

IJ56028
Security scan on broker ports leading to performance issues.

A security scan performed against the IBM Workload Scheduler broker port could cause numerous network connections to remain in a CLOSE_WAIT state, leading to the depletion of system resources (such as file descriptors and memory).

Table 6. IBM Z Workload Scheduler connector – APARs fixed in this release
CodeDescription
IJ55420
REST API returns AWSJDB101E error due to JCL content.

A defect in the REST API processing logic caused the API call to fail and return the following error AWSJDB101E: The object "Invalid argument" was not found. The failure was triggered when the JCL (Job Control Language) contained the //OPC SCAN directory. Although the directory itself is valid, the API returned an unexpected error.

Table 7. Integration with SAP and PeopleSoft – APARs fixed in this release
CodeDescription
IJ56532
SAP jobs fail due to R/3 password decryption error when password ends with "==" characters.

A defect caused SAP jobs to fail with decryption and connection errors after upgrading the master domain manager and Dynamic Workload Console to version 10.2.5. The failure occurred specifically when the SAP password ended with the sequence of double equals signs (==), which is commonly found at the end of base64-encoded strings. The r3batch code failed to correctly read or decrypt the password string when it contained this ending sequence, resulting in connection failure and errors such as EEWO0020E ("An internal error occurred while trying to decrypt the R/3 password") and EEWO0124E ("The following SAP R/3 system... is not running").

Table 8. REST APIs – APARs fixed in this release
CodeDescription
KB0102623
REST API query returns no records when plan filter is used and security check is enabled.

A defect introduced with REST API 2.0 caused queries utilizing the plan filter parameter to fail, incorrectly returning "0 records". This failure occurred specifically when the enListSecChk global option was set to YES on the master domain manager.

KB0110550
REST API V2 submit ad hoc swagger body lacks mandatory task field example.

The documentation for the REST API V2 used to submit an ad-hoc job via the swagger interface lacks a crucial example for the task field, despite this field having mandatory internal values.

KB0123280
REST API V2 returns duplicate keys for dependencyType in plan job output.

A defect in the REST API V2 interface caused the plan job output to contain duplicate key names for the dependencyType field within the dependencies array.

Table 9. Documentation – APARs fixed in this release
CodeDescription
IJ53045
Information needed about custom paths specified for tablespaces.

Custom paths specified for tablespaces using the --iwstspath, --iwslogtspath, and --iwsplantspath parameters during database configuration are not supported and are therefore ignored when configuring Db2, Db2 for Z/OS, Informix, or Oracle databases.

IJ53654
Incorrect statement in the documentation about Dynamic Workload Console database table reorganization.

The database administrator must be informed about reorganizing the tables.

IJ53854
The documentation for configuring Prometheus metric using the prometheus.xml file incorrectly specified the use of CDI-1.2 with IBM Workload Scheduler 10.1 FP5.

This version incompatibility caused metrics to fail to be exposed in affected environments. Need to correct this configuration error. In subsequent releases, the prometheus.xml file has been removed and the metrics configuration procedure is automated.

IJ54592
The product documentation for installation lacked explicit details on the password policy requirements, specifically failing to define the supported special characters and the maximum character length.

Need to clearly specify the password constraints for installation, where enforced in the product. This includes a list of all supported special characters that can be utilized in administrator and system passwords.

IJ54656
The documentation for the BmEvents.conf configuration file incorrectly lists Event ID 102 as the required identifier for failed job events.

Need to list the correct value. The configuration details for failed job events in the BmEvents.conf file should specify Event ID 111, replacing the previous, erroneous listing of Event ID 102.

IJ55084
Different event ids for failed job events on Windows and Linux.

The system generates platform-specific Event IDs for failed job events, which is the expected and intended behavior but requires clarification in the documentation to avoid user confusion.

IJ55413
Improve the examples in the documentation of the absolute interval time dependency.

Need to improve the Examples section within the absolute interval time dependency documentation to provide clearer, more comprehensive, and current usage scenarios for scheduling constraints.

IJ55624
Typographical error in the name of the application_wa_JobsInPlanCount_job metric, which was incorrectly listed as application_wa_JobsInPlanCount_jobs.

This error was present in both the official product documentation and Automation Hub. Need to correct the name into application_wa_JobsInPlanCount_job in both locations.

IJ55625
Duplicate entry for the application_wa_JobsInPlanCount_job metric in both the official product documentation and Automation Hub.

Need to remove the redundant listing of the job count attribute application_wa_JobsInPlanCount_job metric from both the official product documentation and Automation Hub.

IJ55739
Need to create converting custom certificates documentation in the Upgrade documentation.

The "Converting default certificates" documentation does not include the case for which custom certificates had been implemented. The documentation is adequate if the default certificates are the old, self-signed certificates that were formerly packaged with the product.

KB0122668
In the documentation for the SSM agent, need to explicitly document the full path locations of the SSM log files across different operating systems.

Need to clarify the SSM agent documentation to include the two distinct agents: one for the fault-tolerant agent and one for the dynamic agent, including details on their specific deployment and function.

KB0122774
JobManager CPU excessive usage (100%) while submitting restful jobs.

A defect caused the JobManager CPU utilization to increase usage to 100% when submitting RESTful jobs. This excessive CPU usage resulted in performance degradation.

KB0123694
Documentation about SAP jobs failing on extended agent due to file permission error.

Need to update the doc with information about best practices for job security and stability.

Resolved Common Vulnerabilities and Exposures (CVEs)

The following CVEs have been resolved:

Table 10. List of resolved vulnerabilities by severity (sorted by severity, then numerically)
CVE IDSeverity
CVE-2025-6965Major
CVE-2025-40778Major
CVE-2025-40780Major
CVE-2025-47906Major
CVE-2025-47907Major
CVE-2025-47912Major
CVE-2025-55163Major
CVE-2025-58183Major
CVE-2025-58185Major
CVE-2025-58186Major
CVE-2025-58187Major
CVE-2025-58188Major
CVE-2025-58189Major
CVE-2025-61723Major
CVE-2025-61724Major
CVE-2025-61725Major
CVE-2025-5187Normal
CVE-2025-5318Normal
CVE-2025-9714Normal
CVE-2025-11965Normal
CVE-2025-47914Normal
CVE-2025-53905Normal
CVE-2025-53906Normal
CVE-2025-58181Normal
CVE-2025-61727Normal
CVE-2025-61729Normal
CVE-2025-7962Normal
CVE-2025-8058Normal

Interoperability tables

In the tables in this section the following acronyms are used:

Table 11. Acronym table
AcronymExtended form
DADynamic agent
DDMdynamic domain manager or backup dynamic domain manager
DMdomain manager
DWCDynamic Workload Console
FTAfault-tolerant agent
MDMmaster domain manager
BKMbackup master domain manager
ZWS agentIBM Z Workload Scheduler Agent

 

Compatibility is supported on the latest available release level for each IBM Workload Scheduler release listed in the table:

 

Table 12. Compatibility table for IBM Workload Scheduler
ComponentMDMDDMDMFTADAZWS agent
MDM 10.2.6 
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
DM 10.2.6
  • 10.x.x
  • 9.5.0.x
  
  • 10.x.x
  • 9.5.0.x
  
FTA 10.2.6
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
   
DA 10.2.6
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
   
DDM 10.2.6
  • 10.x.x
  • 9.5.0.x
  
  • 10.x.x
  • 9.5.0.x
  • 10.x.x
  • 9.5.0.x
 

 

Note: Version 9.5 is no longer supported. It appears in this table with a recommendation to upgrade to a currently supported version.
 
 
Table 13. Compatibility table for AIDA
ComponentMDMDDMDWC
AIDA 10.2.610.x.x10.x.x10.x.x

Compatibility scenarios and limitations

It is highly recommended to keep all IBM Workload Scheduler components updated to the latest version as part of regular maintenance. This not only maintains a consistent environment but also enables you to utilize new features introduced in each release.

Known limitations and workarounds

The following are software limitations and workarounds that affect IBM Workload Scheduler 10.2.6:

Certificate rotation not working properly on agents

Ensure you install the packages for APAR IJ57691 before installing or upgrading. This fix ensures automatic certificate rotation works correctly on 10.2.6 agents and is available on IBM Fix Central. For the detailed procedure to apply the workaround, see IJ57691 Automatic download of certificates will loop on Agent 10.2.6.

Mixed-version environment with a master domain manager at a version earlier than 9.5 FP4

Before you install a component at version 10.2.6 in an environment with a master domain manager at a version earlier than 9.5 FP4, install the fix for IJ47731 on the back-level master domain manager.

  • For version 9.4 FP7, the fix is available from IBM Fix Central.
  • For other product versions, contact Software Support.

Event-driven workload automation (EDWA) proxy does not support HTTPS connections

Event-driven workload automation (EDWA) proxy supports only HTTP connections. As a result, SSL communication is not supported.

Linking a fault-tolerant agent earlier than 10.2 in an environment configured with certificates

If you link a fault-tolerant agent earlier than V10.2 to an environment with a master domain manager at version 10.2.1 or later using certificates, you need to manually install the certificates on the fault-tolerant agent. To perform the manual installation, you can follow the steps below:

  1. Shut down the workstation of the fault-tolerant agent
  2. Create a backup of the localopts file
  3. Create a new folder under the target fault-tolerant agent as in the following example: <TWS_DATA_DIR>/<new_cert_folder>
  4. From the master domain manager, copy the files under TWA_DATA_DIR/ssl/depot
  5. Paste the TWA_DATA_DIR/ssl/depot files from the master domain manager into the <TWS_DATA_DIR>/<new_cert_folder> new directory
  6. Update the localopts file of the fault-tolerant agent by changing the values of the following properties:
    • SSL Key: <TWS_DATA_DIR>/<new_cert_folder>/tls.key
    • SSL Certificate: <TWS_DATA_DIR>/<new_cert_folder>/tls.crt
    • SSL key pwd: <TWS_DATA_DIR>/<new_cert_folder>/tls.sth
    • SSL CA certificate: <TWS_DATA_DIR>/<new_cert_folder>/ca.crt
  7. Turn on the workstation of the fault-tolerant agent.

The centralized update on a stand-alone fault-tolerant agent V10.2.1 is not supported

The centralized update on a fault-tolerant agent V10.2.1 is not supported, regardless of the operating system. For more information about upgrading from different versions, see Performing the centralized agent update on a stand-alone fault-tolerant agent.

ITLM tool incorrectly discovering z-centric agents

After installing a dynamic agent, the ITLM tool might incorrectly discover a z-centric agent. You can find two possible reasons and their workarounds below:

The directory in which you temporary unzipped package images contains a wrong tag

If you did not delete the temporary directory, delete the following file:

ibm.com_IBM_Z_Workload_Scheduler_Agent-9.5.0.swidtag

The directory in which you installed the package contains a wrong tag

To avoid the issue, delete the ibm.com_IBM_Z_Workload_Scheduler_Agent-9.5.0.swidtag file from the following path:

<IWS_installation_directory>/properties/version

Pool connection issues with CyberArk

If you are using a pool as a gateway to communicate with CyberArk and an agent within the pool loses connection to the CyberArk server, the job assigned to that specific agent fails. For instance, if an agent remains up and running but stops communicating with CyberArk, any jobs assigned to that agent that require a connection to CyberArk fails. This occurs because the pool lacks the ability to verify whether its agents are connected to the CyberArk server.

Folder filtering discrepancy in Command Line Interfaces

Filtering for jobs and job streams within folders with Orchestration CLI or REST APIs V2 using conman syntax might not work as expected, returning different results from the ones retrieved using conman.

Japanese characters might display incorrectly in job logs on Windows for Dynamic Workload Console and fault-tolerant agents

Job logs containing Japanese characters might appear garbled when viewed in the Dynamic Workload Console or when using the command line on fault-tolerant agents running on Windows operating systems.

Workaround

To resolve this issue, set a Windows environment variable that points to the IBM Workload Scheduler home directory, for example:

TWS_TISDIR=C:\FTA\TWS

Resource CLI commands not supported on Windows workstations

Resource CLI commands are currently not supported on Windows workstations.

The diagnostic tool wa_pull_info is not producing any output on Windows operating systems

When you launch the wa_pull_info command on Windows operating systems, the command ends without producing the expected .zip file in the default folder.

Unresolved dependency state with shadow jobs and start of day setting

Successor jobs remain permanently in the HOLD state, even after the shadow job predecessors successfully complete. This happens specifically when the job stream execution crosses the customized Start of Day boundary due to the job rerun logic. The product correctly updates the final status of the shadow job to SUCC, but the dependency is not released when the related scheduling event occurs close to or across the startOfDay. The job is effectively orphaned in the queue, stuck in HOLD despite having met its only prerequisite.

ABENDPROMPT Failure to Suppress RERUN on AIX operating systems

On AIX operating systems, the presence of an ABENDPROMPT setting fails to correctly block the automatic execution of the RECOVERY RERUN action when a job terminates in the ABEND state.

The job manager fails to prioritize the prompt mechanism, which should transition the job to a waiting state and generate an immediate ASKED prompt, thereby overriding or delaying the automatic RERUN defined in the recovery policy.

This failure results in an uncontrolled automatic rerun, bypassing the required human intervention point defined by the ABENDPROMPT setting.

Certificate expiration date is not visible for dynamic agents connecting to dynamic domain managers

The certificate expiration date is not visible when a dynamic agent connects to a dynamic domain manager.

Database support for dynamic domain managers

The installation and operation of dynamic domain managers are exclusively supported with Db2, Oracle, and MSSQL databases. The PostgreSQL database is currently not supported for use with dynamic domain managers.

Certificate management for agents on IBM i

When installing dynamic agents on IBM i, ensure the required certificate files are available on the agent and use only the sslkeysfolder and sslpassword parameters to configure them. Downloading certificates using the wauser and wapassword parameters is not supported.

 

Package structure

For a detailed list of available packages, see the 10.2.6 Quick Start Guide document available from IBM Fix Central.

Software requirements for WebSphere Application Server Liberty Base

WebSphere Application Server Liberty Base adopts a continuous delivery model where new versions are deployed on a monthly basis.

During formal testing, IBM Workload Scheduler and the Dynamic Workload Console were tested using WebSphere Application Server Liberty Base version 25.0.0.11. The minimum required version to successfully install the product is 25.0.0.9

For the Dynamic Workload Console installed in a z/OS environment, testing was conducted using WebSphere Application Server Liberty Base version 25.0.0.9, which is also the minimum required version for that configuration.

For more information about which subsequent versions of WebSphere Application Server Liberty Base can be used in the future, see Recommended updates for WebSphere Application Server.

Installing and upgrading to version 10.2.6

This section describes how to install or upgrade to version 10.2.6.

Before installing the release, ensure you have installed the required prerequisite software. To obtain the latest information about system requirements, run the Detailed System Requirements report and browse to the relevant section.

Installation notes

  • If you plan to perform a fresh installation with WebSphere Application Server Liberty 26.0.0.3 or later, set the SECUREWRAP_PASSPHRASE environment variable to a custom passphrase of your choice before you run the installation command. If you are upgrading IBM Workload Scheduler or WebSphere Application Server Liberty, no action is required. For more information, see IWS 10.2.x earlier than 10.2.7 returns installation failure with Liberty 26.0.0.3.
  • Before performing an upgrade, check whether the ssl_config.xml file is present in the overrides folder. If the file is present, check the verifyHostname option in the twaSSLSettings section. The verifyHostname must be set to false, as shown in the following example:

    <ssl id="twaSSLSettings" keyStoreRef="twaKeyStore" trustStoreRef="twaTrustStore" 
    sslProtocol="TLSv1.2" clientAuthenticationSupported="true" verifyHostname="false"/>
  • Depending on the WebSphere Application Server Liberty version you are using, you might encounter the problems described in the following technotes:

Versions equal to or higher than 24.0.0.8

See Possible IWS compatibility issues with Liberty 24.0.0.8 or higher

Versions ranging from 24.0.0.3 to 24.0.0.8

See Dynamic Workload Console is not able to open "Monitor Event Rules" nor "Manage workload security" with OpenID authentication

Upgrade notes

If you are using MSSQL and are upgrading from a release earlier than 10.2.3, perform the steps listed below after upgrading to version 10.2.6. If you are using MSSQL and are upgrading from release 10.2.3 or a release later than 10.2.3, you can ignore the steps listed below.

  1. Browse to the datasource.xml template.
  2. Open the file with a text editor and perform the following changes:
    1. Add the lines listed below after the db.driver.path parameter:

      <variable name="db.encrypt" value="false"/>
      <variable name="db.trustServerCertificate" value="false"/>
    2. Append the following strings at the end of the value of the mssql.URL parameter:

      ;encrypt=${db.encrypt};trustServerCertificate=${db.trustServerCertificate}
    3. Add the lines listed below after the integratedSecurity parameter:

      encrypt="${db.encrypt}"
      trustServerCertificate="${db.trustServerCertificate}"

      The resulting file looks as follows. The modified sections are highlighted in bold:

      ...	
      	<variable name="db.driver.path" value="<db_driver_path>"/>
      	<variable name="db.encrypt" value="false"/>
      	<variable name="db.trustServerCertificate" value="false"/>
      	<variable name="mssql.URL" value="jdbc:sqlserver://${db.serverName}:${db.portNumber};databaseName=${db.databaseName}
             ;encrypt=${db.encrypt};trustServerCertificate=${db.trustServerCertificate}"/>
      	<jndiEntry value="MSSQL" jndiName="db.type" />
      ...
      		    integratedSecurity="false"
      		    encrypt="${db.encrypt}"
      		    trustServerCertificate="${db.trustServerCertificate}"
  3. Stop and restart WebSphere Application Server Liberty to make the changes effective.

When upgrading to Dynamic Workload Console version 1025, if the previous environment is configured for Single Sign-On (SSO) using ltpa.keys, perform the following steps:

  1. copy the ltpa.keys file either from the master domain manager to the workstation hosting the Dynamic Workload Console, or vice versa, depending on your configuration.
  2. After copying, restart the IBM Workload Scheduler processes on the component where the ltpa.keys file was updated to complete the SSO setup.

Installation and upgrade procedures

You can install the release using the procedure described in Installing from the CLI.

You can upgrade to the current release using the procedure described in Upgrading from the CLI.

Disk space requirements

To obtain the latest information about permanent disk space requirements when installing on supported operating systems, run the Hardware requirements report and click on the relevant operating system link.

Performing the centralized agent update on a stand-alone fault-tolerant agent

Before performing a centralized update on fix packs or upgrade on releases on a stand-alone fault-tolerant agent to 10.2.6, there are procedures to follow according to the version of the fault-tolerant agent from which you want to upgrade.

Note: When upgrading a dynamic agent together with a fault-tolerant agent to 10.2.6, if you start the upgrade from the dynamic agent there are no further steps required. The same applies when performing an upgrade of the fault-tolerant agent starting from a dynamic agent.

The table below shows which procedure you must follow to perform the upgrade, according to the fault-tolerant agent version.

Table 14. Steps required before performing the centralized agent update on a stand-alone fault-tolerant agent
Stand-alone fault-tolerant agent versionRequired steps
V9.5 Fix Pack 4 up to V9.5 Fix Pack 6If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description
V9.5 Fix Pack 7No steps required.
V10.1 up to V10.1 Fix Pack 3

If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description.

Then, from the same workstation where the fault-tolerant agent

is installed, copy the TWSClientKeyStore files from TWA_DATA_DIR/ssl/GSKit to TWA_DATA_DIR/ITA/cpa/ita/cert.

Note: The owner of the new TWSClientKeyStore files and the permissions granted must be the same of the existing files.
V10.1 Fix Pack 4

If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description.

Then, download the curl file from APAR IJ50967 and save it inside TWS/ITA/cpa/ita.

Note: The owner of the new curl file and the permissions granted must be the same of the existing curl file.
V10.2

If not already enabled, enable the use of the HTTPS protocol to connect to the event processor server. For more information about enabling enEventProcessorHttpsProtocol | eh, see Global options - detailed description.

Then, download the curl file from APAR IJ50967 and save it inside TWS/ITA/cpa/ita.

Note: The owner of the new curl file and the permissions granted must be the same of the existing curl file.
V10.2.1Not supported.
V10.2.2 and laterNo additional procedure required.

Documentation updates

Any additions or changes to the documentation as a result of this release have been integrated into the online product documentation available in IBM Workload Scheduler product information.

Contacting IBM Workload Scheduler Software Support

Before contacting IBM Software Support with a problem, refer to the IBM Software Support site by accessing the following Web address: https://www.ibm.com/support/home/

To access IBM support, click the IBM support link at the bottom right of the page.

If you want to contact IBM Software Support, see the IBM Software Support Handbook at the following Web site: http://techsupport.services.ibm.com/guides/handbook.html

The guide provides information about how to contact IBM Software Support, depending on the severity of your problem, and the following information:

  • Registration and eligibility.
  • Telephone numbers, depending on the country in which you are located.
  • Information you must have before contacting IBM Software Support.

Notices

This information was developed for products and services offered in the US. This material might be available from IBM Workload Scheduler in other languages. However, you may be required to own a copy of the product or product version in that language in order to access it.

IBM Workload Scheduler may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM Workload Scheduler representative for information on the products and services currently available in your area. Any reference to an IBM Workload Scheduler product, program, or service is not intended to state or imply that only that IBM Workload Scheduler product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM Workload Scheduler intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM Workload Scheduler product, program, or service.

IBM Workload Scheduler may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
US
 

 

For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Workload Scheduler Intellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan

 

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM Workload Scheduler may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Workload Scheduler websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM Workload Scheduler product and use of those websites is at your own risk.

IBM Workload Scheduler may use or distribute any of the information you provide in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
US
 

 

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM Workload Scheduler under terms of the IBM Workload Scheduler Customer Agreement, IBM Workload Scheduler International Program License Agreement or any equivalent agreement between us.

The performance data discussed herein is presented as derived under specific operating conditions. Actual results may vary.

Information concerning non-IBM Workload Scheduler products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM Workload Scheduler has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM Workload Scheduler products. Questions on the capabilities of non-IBM Workload Scheduler products should be addressed to the suppliers of those products.

This information is for planning purposes only. The information herein is subject to change before the products described become available.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to actual people or business enterprises is entirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM Workload Scheduler, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM Workload Scheduler, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM Workload Scheduler shall not be liable for any damages arising out of your use of the sample programs.

© IBM Workload
                              Scheduler 2006, 2016. All rights reserved. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.


© Copyright HCL Technologies Limited 2016, 2025.
Portions of this code are derived from IBM Workload Scheduler Sample Programs.
 

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

Adobe™, the Adobe logo, PostScript™, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries.

IT Infrastructure Library™ is a Registered Trade Mark of AXELOS Limited.

Linear Tape-Open™, LTO™, the LTO Logo, Ultrium™, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.

Intel™, Intel logo, Intel Inside™, Intel Inside logo, Intel Centrino™, Intel Centrino logo, Celeron™, Intel Xeon™, Intel SpeedStep™, Itanium™, and Pentium™ are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

Linux™ is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft™, Windows™, Windows NT™, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.


Java Logo
 
Java™ and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.

Cell Broadband Engine™ is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom.

ITIL™ is a Registered Trade Mark of AXELOS Limited.

UNIX™ is a registered trademark of The Open Group in the United States and other countries.

Terms and conditions for product documentation

Permissions for the use of these publications are granted subject to the following terms and conditions.

Applicability

These terms and conditions are in addition to any terms of use for the IBM Workload Scheduler website.

Personal use

You may reproduce these publications for your personal, noncommercial use provided that all proprietary notices are preserved. You may not distribute, display or make derivative work of these publications, or any portion thereof, without the express consent of IBM Workload Scheduler.

Commercial use

You may reproduce, distribute and display these publications solely within your enterprise provided that all proprietary notices are preserved. You may not make derivative works of these publications, or reproduce, distribute or display these publications or any portion thereof outside your enterprise, without the express consent of IBM Workload Scheduler.

Rights

Except as expressly granted in this permission, no other permissions, licenses or rights are granted, either express or implied, to the publications or any information, data, software or other intellectual property contained therein.

IBM Workload Scheduler reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use of the publications is detrimental to its interest or, as determined by IBM Workload Scheduler, the above instructions are not being properly followed.

You may not download, export or re-export this information except in full compliance with all applicable laws and regulations, including all United States export laws and regulations.

IBM Workload Scheduler MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS ARE PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSGSPN","label":"IBM Workload Scheduler"},"ARM Category":[{"code":"a8m3p000000UoZVAA0","label":"Continuous Delivery"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF012","label":"IBM i"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"10.2.6"}]

Document Information

Modified date:
04 May 2026

UID

ibm17249253