Db2 – How to stop a db2 instance properly

What we ended up doing was rebuilding our environment since it was only "development" anyway. We installed DB2 Connect rather than the Runtime-Client so that way we could catalog the iSeries databases and the LUW databases for Cognos to use.

We also could have used a gateway pattern where we could have set up DB2 Connect as a "Gateway Server" and cataloged the iSeries databases there and then cataloged the databases from the Gateway Server on the Runtime Client. That would have gotten us around our original issue too.

Interestingly enough, we were steered away from using a Gateway Server when we rebuilt our environment. No reason why. Even though IBM supports it, they don't recommend it. Only thing I can think of is that it introduces another failure point.

There are several aspects that you might want to consider.

Firstly, you can assign proper authorities to the target instance owner during the restore automatically by using the DB2_RESTORE_GRANT_ADMIN_AUTHORITIES registry variable. If it's set to ON prior to the restore, the user performing the restore will get those authorities.

Secondly, most of the binding/compiling problems come from the fact that only the object owner, that is, the authorisation ID that created the object in the first place, is given permissions to perform certain operations on it. If you run DDL scripts in production as the instance owner, then this would be the owner ID of all objects after the restore, no matter the DB2_RESTORE_GRANT_ADMIN_AUTHORITIES setting. You could, of course, use the TRANSFER OWNERSHIP statement to change that, but in real life, with tens of thousands of objects in the database, this may not be practical.

To avoid the "secondly" part, in many organisations folks use a special "builder" authorisation ID, separate from the instance owner, to run DDL scripts. This ID will not be given any unnecessary privileges, can be tightly controlled, and, when existing in all environments, should be able to perform all necessary tasks without adding security exposure.