GoogleCloudPlatform · nj1973 · Dec 5, 2025 · Dec 17, 2025 · Dec 17, 2025 · Dec 17, 2025
diff --git a/README.md b/README.md
@@ -23,7 +23,8 @@ DVT supports the following connection types:
 
 *   [AlloyDB](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#alloydb)
 *   [BigQuery](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#google-bigquery)
-*   [DB2](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#db2)
+*   [Db2 LUW](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#db2_luw)
+*   [Db2 z/OS](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#db2_zos)
 *   [FileSystem](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#filesystem)
 *   [Hive](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#hive)
 *   [Impala](https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/connections.md#impala)
@@ -70,7 +71,7 @@ The CLI is the main interface to use this tool and it has several different
 commands which can be used to create and run validations. DVT is designed to run in
 an environment connected to GCP services, specifically, BigQuery, GCS and Secret manager.
 If DVT is being run on-premises or in an environment with restricted access to GCP services, see
-[running DVT  at on-prem](#running-dvt-at-on-prem). Below are the command syntax and options for running validations.
+[running DVT at on-prem](#running-dvt-at-on-prem). Below are the command syntax and options for running validations.
 
 Alternatives to running DVT in the CLI include deploying DVT to Cloud Run, Cloud Functions, or Airflow
 ([Examples Here](https://github.com/GoogleCloudPlatform/professional-services-data-validator/tree/develop/samples)). See the [Validation Logic](https://github.com/GoogleCloudPlatform/professional-services-data-validator#validation-logic) section

diff --git a/data_validation/cli_tools.py b/data_validation/cli_tools.py
@@ -199,13 +199,24 @@
         ["http_path", "URL path of HTTP proxy"],
     ],
     consts.SOURCE_TYPE_DB2: [
-        ["host", "DB2 host"],
-        ["port", "DB2 port (50000 if not provided)"],
+        ["host", "Db2 host"],
+        ["port", "Db2 port (50000 if not provided)"],
         ["user", "Username to connect to"],
         ["password", "Password for authentication of user"],
-        ["database", "Database in DB2 to connect to"],
-        ["url", "URL link in DB2 to connect to"],
-        ["driver", "Driver link in DB2 to connect to (default ibm_db_sa)"],
+        ["database", "Database in Db2 to connect to"],
+        ["url", "URL link in Db2 to connect to"],
+        ["driver", "Driver link in Db2 to connect to (default ibm_db_sa)"],
+        ["connect_args", "(Optional) Additional connection argument mapping"],
+    ],
+    consts.SOURCE_TYPE_DB2_ZOS: [
+        ["host", "Db2 host"],
+        ["port", "Db2 port (50000 if not provided)"],
+        ["user", "Username to connect to"],
+        ["password", "Password for authentication of user"],
+        ["database", "Database in Db2 to connect to"],
+        ["url", "URL link in Db2 to connect to"],
+        ["driver", "Driver link in Db2 to connect to (default ibm_db_sa)"],
+        ["connect_args", "(Optional) Additional connection argument mapping"],
     ],
 }
 

diff --git a/data_validation/clients.py b/data_validation/clients.py
@@ -53,6 +53,7 @@
     "oracle",
     "postgres",
     "db2",
+    "db2_zos",
     "mssql",
     "redshift",
     "snowflake",
@@ -91,8 +92,10 @@ def get_client_call(*args, **kwargs):
 # DB2 requires ibm_db_sa
 try:
     from third_party.ibis.ibis_db2.api import db2_connect
+    from third_party.ibis.ibis_db2_zos.api import db2_zos_connect
 except ImportError:
     db2_connect = _raise_missing_client_error("pip install ibm_db_sa")
+    db2_zos_connect = _raise_missing_client_error("pip install ibm_db_sa")
 
 # Sybase requires sqlalchemy_sybase package.
 try:
@@ -227,6 +230,7 @@ def get_ibis_table(client, schema_name, table_name, database_name=None):
         "oracle",
         "postgres",
         "db2",
+        "db2_zos",
         "mssql",
         "redshift",
         "sybase",
@@ -430,4 +434,5 @@ def get_max_in_list_size(client, in_list_over_expressions=False):
     consts.SOURCE_TYPE_SPANNER: spanner_connect,
     consts.SOURCE_TYPE_SYBASE: sybase_connect,
     consts.SOURCE_TYPE_DB2: db2_connect,
+    consts.SOURCE_TYPE_DB2_ZOS: db2_zos_connect,
 }
diff --git a/data_validation/config_manager.py b/data_validation/config_manager.py
@@ -676,11 +676,25 @@ def _is_db2_blob(self, source_column_name: str, target_column_name: str) -> bool
         )
 
     def _is_db2_xml(self, source_column_name: str, target_column_name: str) -> bool:
-        """Returns True when either source or target column is Oracle LOB data type."""
+        """Returns True when either source or target column is Db2 XML data type."""
         return self._is_raw_data_type(
             "db2", source_column_name, target_column_name, ["XML"]
         )
 
+    def _is_db2_zos_blob(
+        self, source_column_name: str, target_column_name: str
+    ) -> bool:
+        """Returns True when either source or target column is Db2 z/OS BLOB data type."""
+        return self._is_raw_data_type(
+            "db2_zos", source_column_name, target_column_name, ["BLOB"]
+        )
+
+    def _is_db2_zos_xml(self, source_column_name: str, target_column_name: str) -> bool:
+        """Returns True when either source or target column is Db2 z/OS XML data type."""
+        return self._is_raw_data_type(
+            "db2_zos", source_column_name, target_column_name, ["XML"]
+        )
+
     def _is_oracle_lob(self, source_column_name: str, target_column_name: str) -> bool:
         """Returns True when either source or target column is Oracle LOB data type.
 
@@ -1066,7 +1080,11 @@ def require_pre_agg_calc_field(
                     # Oracle BLOB is invalid for use with SQL COUNT function.
                     # The expression below returns True if client is Oracle which
                     # has the effect of triggering use of byte_length transformation.
-                    return self._is_oracle_lob(source_column, target_column)
+                    # Same for Db2 z/OS.
+                    return bool(
+                        self._is_oracle_lob(source_column, target_column)
+                        or self._is_db2_zos_blob(source_column, target_column)
+                    )
                 else:
                     # Convert to length for any min/max/sum on binary columns.
                     return True
@@ -1154,6 +1172,11 @@ def require_pre_agg_calc_field(
                     f"Skipping {agg_type} on {column} due to SQL Server image data type"
                 )
                 continue
+            elif self._is_db2_zos_xml(column, column):
+                logging.info(
+                    f"Skipping {agg_type} on {column} due to Db2 z/OS XML data type"
+                )
+                continue
             elif agg_type != "count" and self._is_db2_xml(column, column):
                 logging.info(
                     f"Skipping {agg_type} on {column} due to Db2 XML data type"

diff --git a/data_validation/consts.py b/data_validation/consts.py
@@ -130,6 +130,7 @@
 # Connection key constants.
 SOURCE_TYPE_BIGQUERY = "BigQuery"
 SOURCE_TYPE_DB2 = "DB2"
+SOURCE_TYPE_DB2_ZOS = "DB2_ZOS"
 SOURCE_TYPE_FILESYSTEM = "FileSystem"
 SOURCE_TYPE_IMPALA = "Impala"
 SOURCE_TYPE_MSSQL = "MSSQL"

diff --git a/data_validation/query_builder/random_row_builder.py b/data_validation/query_builder/random_row_builder.py
@@ -20,7 +20,7 @@
 from data_validation.query_builder.query_builder import QueryBuilder
 
 # Adding new data sources should be done by adding the Backend name here
-RANDOM_SORT_SUPPORTS = [
+SUPPORTS_SORT_BY_RANDOM = [
     "bigquery",
     "teradata",
     "impala",
@@ -35,6 +35,10 @@
     "sybase",
 ]
 
+SUPPORTS_SORT_BY_ALIASED_RANDOM = [
+    "db2_zos",
+]
+
 
 class RandomRowBuilder(object):
     def __init__(self, primary_keys: List[str], batch_size: int):
@@ -87,7 +91,16 @@ def maybe_add_random_sort(
         self, data_client: ibis.backends.base.BaseBackend, table: ibis.Expr
     ) -> ibis.Expr:
         """Return a randomly sorted query if it is supported for the client."""
-        if data_client.name in RANDOM_SORT_SUPPORTS:
+        if data_client.name in SUPPORTS_SORT_BY_ALIASED_RANDOM:
+            random_sort_col = "random_sort"
+            return (
+                table[self.primary_keys]
+                .mutate(**{random_sort_col: ibis.random()})
+                .order_by(random_sort_col)
+                .limit(self.batch_size)[self.primary_keys]
+            )
+
+        if data_client.name in SUPPORTS_SORT_BY_RANDOM:
             # Teradata 'SAMPLE' and Spanner 'TABLESAMPLE' is random by nature
             # and does not require a sort by
             if data_client.name == "teradata" or data_client.name == "spanner":

diff --git a/data_validation/util.py b/data_validation/util.py
@@ -97,7 +97,7 @@ def dvt_temp_object_name(prefix: str = "dvt_temp") -> str:
         prefix: The prefix to use for the temporary object name.
 
     Returns:
-        A lower case random name for when DVT needs to create a temporary object.
+        A random name for when DVT needs to create a temporary object.
     """
     if not isinstance(prefix, str) or not re.match(r"^[a-zA-Z0-9_]+$", prefix):
         raise exceptions.ValidationException(

diff --git a/docs/connections.md b/docs/connections.md
@@ -89,7 +89,8 @@ The data validation tool supports the following connection types.
 * [FileSystem](#filesystem-csv-orc-parquet-or-json-only)
 * [Impala](#impala)
 * [Hive](#hive)
-* [DB2](#db2)
+* [Db2 LUW](#db2)
+* [Db2 z/OS](#db2_zos)
 * [AlloyDB](#alloydb)
 * [Snowflake](#snowflake)
 * [Sybase ASE](#sybase-ase)
@@ -411,22 +412,61 @@ data-validation connections add
 
 ```
 
-## DB2
+## Db2 LUW
 
-DB2 requires the `ibm_db_sa` package. We currently support only IBM DB2 LUW - Universal Database for Linux/Unix/Windows versions 9.7 onwards.
+Db2 requires the `ibm_db_sa` package. We currently support only IBM Db2 LUW - Universal Database for Linux/Unix/Windows versions 9.7 onwards.
 
 ```
 data-validation connections add
     [--secret-manager-type <None|GCP>]                  Secret Manager type (None, GCP)
     [--secret-manager-project-id SECRET_PROJECT_ID]     Secret Manager project ID
-    --connection-name CONN_NAME DB2                     Connection name
-    --host HOST                                         DB2 host
-    --port PORT                                         DB2 port, defaults to 50000
-    --user USER                                         DB2 user
-    --password PASSWORD                                 DB2 password
-    --database DATABASE                                 DB2 database
+    --connection-name CONN_NAME Db2                     Connection name
+    --host HOST                                         Db2 host
+    --port PORT                                         Db2 port, defaults to 50000
+    --user USER                                         Db2 user
+    --password PASSWORD                                 Db2 password
+    --database DATABASE                                 Db2 database
     [--url URL]                                         SQLAlchemy connection URL
-    [--driver DRIVER]                                   DB2 driver, defaults to "ibm_db_sa"
+    [--driver DRIVER]                                   Db2 driver, defaults to "ibm_db_sa"
+    [--connect-args CONNECT_ARGS]                       Additional connection args, JSON String dict, default {}
+```
+
+Example TLS connection:
+```
+data-validation connections add -c db2conn DB2 \
+  --host=sdb2-host --database=somedb \
+  --user=dvt --password=DVTS3cret \
+  --connect-args='{"Security": "SSL", "SSLClientKeystoredb": "/path/to/file.kdb", "SSLClientKeystash": "/path/to/file.sth"}'
+```
+
+## Db2 z/OS
+
+Db2 requires the `ibm_db_sa` package.
+
+```
+data-validation connections add
+    [--secret-manager-type <None|GCP>]                  Secret Manager type (None, GCP)
+    [--secret-manager-project-id SECRET_PROJECT_ID]     Secret Manager project ID
+    --connection-name CONN_NAME DB2_zOS                 Connection name
+    --host HOST                                         Db2 host
+    --port PORT                                         Db2 port, defaults to 50000
+    --user USER                                         Db2 user
+    --password PASSWORD                                 Db2 password
+    --database DATABASE                                 Db2 database
+    [--url URL]                                         SQLAlchemy connection URL
+    [--driver DRIVER]                                   Db2 driver, defaults to "ibm_db_sa"
+    [--connect-args CONNECT_ARGS]                       Additional connection args, JSON String dict, default {}
+```
+
+Db2 permissions required to run DVT custom-query validations:
+- CREATE VIEW. See [Db2 z/OS limitations](limitations.md#db2-zos).
+
+Example TLS connection:
+```
+data-validation connections add -c db2conn DB2_zOS \
+  --host=sdb2-host --database=somedb \
+  --user=dvt --password=DVTS3cret \
+  --connect-args='{"Security": "SSL", "SSLClientKeystoredb": "/path/to/file.kdb", "SSLClientKeystash": "/path/to/file.sth"}'
 ```
 
 Db2 permissions required to run DVT custom-query validations:

diff --git a/docs/limitations.md b/docs/limitations.md
@@ -11,10 +11,19 @@
 ## Db2 LUW
 
 - Db2 LUW BLOB datatype is excluded from row validation due to incompatibility with concatenation/hashing functions.
+- Db2 LUW XML data type is not compatible with the LENGTH function and is excluded from any column validations other than `--count`.
 - Db2 LUW custom query validations require the creation of temporary views in the database to resolve additional data type information.
   This requires CREATE VIEW privileges for the connected user. Without it some data types will not be resolved correctly, for
   example CHARACTER will be interpreted as VARCHAR.
 
+## Db2 z/OS
+
+- Db2 z/OS XML data type is not compatible with aggregation functions or LENGTH function and is excluded from all column validations.
+- Db2 z/OS custom query validations require the creation of temporary views in the database to resolve additional data type information.
+  This requires CREATE VIEW privileges for the connected user. Without it some data types will not be resolved correctly, for
+  example CHARACTER will be interpreted as VARCHAR.
+- Db2 Z/OS ROWID data type is not supported.
+
 ## Oracle
 
 - Requires the `oracledb` package to be installed as an extra dependency.
@@ -42,4 +51,4 @@
 ## Teradata
 
 - Requires the `teradatasql` package to be installed as an extra dependency.
-- Teradata does not have a native SHA-256 hash function but a third party UDF can be (installed)[https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/installation.md#teradata].
+- Teradata does not have a native SHA-256 hash function but a third party UDF can be (installed)[https://github.com/GoogleCloudPlatform/professional-services-data-validator/blob/develop/docs/installation.md#teradata].
diff --git a/tests/resources/db2_test_tables.sql b/tests/resources/db2_test_tables.sql
@@ -242,3 +242,19 @@ INSERT INTO pso_data_validator.dvt_tricky_dates VALUES
 -- NULL in all columns.
 INSERT INTO pso_data_validator.dvt_tricky_dates (id) VALUES (2);
 COMMIT;
+
+-- pso_data_validator.dvt_db2_generated_cols1 has fake generated columns that should be ignored.
+CREATE TABLE IF NOT EXISTS pso_data_validator.dvt_db2_generated_cols1
+(   id                          INTEGER NOT NULL PRIMARY KEY
+,   col_int                     INTEGER
+,   db2_generated_docid_for_xml INTEGER
+,   db2_generated_rowid_for_lob INTEGER);
+COMMENT ON TABLE pso_data_validator.dvt_db2_generated_cols1 IS 'Test table to prove generated columns are ignored.';
+INSERT INTO pso_data_validator.dvt_db2_generated_cols1 VALUES (1,1,1,1);
+COMMIT;
+-- pso_data_validator.dvt_db2_generated_cols2 no fake generated columns, tests in tandem with dvt_db2_generated_cols1.
+CREATE TABLE IF NOT EXISTS pso_data_validator.dvt_db2_generated_cols2
+(   id                          INTEGER NOT NULL PRIMARY KEY
+,   col_int                     INTEGER);
+COMMENT ON TABLE pso_data_validator.dvt_db2_generated_cols2 IS 'Test table to prove generated columns are ignored.';
+INSERT INTO pso_data_validator.dvt_db2_generated_cols2 VALUES (1,1);