Why Connect Db2 to Monte Carlo?

Integrating Monte Carlo with Db2 allows you to monitor your data assets through custom SQL monitors, metrics, validations and comparisons, which can be created in either the UI wizard and/or programmatically via monitors as code (API/SDK too). These monitors can be used to generate notifications (incidents) to relevant stakeholders and circuit break pipelines.

Monitor & Lineage Support

Below are the monitors & lineage for the Db2 integration today. Please reach out to your Monte Carlo representative if you have requirements for additional monitors.

*freshness and volume monitors are available via user opt-in for each table. These monitors would run count(＊) queries for each table to detect freshness and volume anomalies.

Connecting to Db2

Now that we know the value connecting Db2 to Monte Carlo can bring, here are the necessary steps to set up the integration.

📘

Prerequisites

To create a service account, you will need admin credentials to your Db2 database.

This guide explains how to create a read-only service account for Monte Carlo in your Db2 database. Once your service account is created, you can onboard the Db2 integration using the Monte Carlo UI or using the CLI.

1. Create a read-only service account

The recommended way to grant Monte Carlo access to your Db2 database, is to create a dedicated, read-only role and assign it to a dedicated Monte Carlo user. Db2 users are managed outside of the database, typically via the operating system. Create a user named monte_carlo . To create a role, connect to the database as a user with SECADM authority, and run the following query:

CREATE ROLE MONTE_CARLO_ROLE;
GRANT ROLE MONTE_CARLO_ROLE TO USER monte_carlo

In order to collect metadata, Monte Carlo requires access to the SYSCAT and SYSIBM schemas. Monte Carlo also requires access to any schemas that include tables to be monitored. To grant the required permissions, run the following queries:

GRANT CONNECT ON DATABASE TO ROLE MONTE_CARLO_ROLE;
GRANT SELECTIN ON SCHEMA SYSCAT TO ROLE MONTE_CARLO_ROLE;
GRANT SELECTIN ON SCHEMA SYSIBM TO ROLE MONTE_CARLO_ROLE;
GRANT SELECTIN ON SCHEMA <schema_to_monitor> TO ROLE MONTE_CARLO_ROLE;

2a. Onboard Db2 Integration using the Monte Carlo UI (No SSL)

With the service user created, you can add a Db2 integration using our onboarding wizard.

• Deployment: [Optional] If you have multiple deployments already in your Monte Carlo account, choose the deployment you want to use for this integration. If you do not have multiple deployments, this field will not be shown.
• Integration name: The user-friendly name for this integration.
• Host: The host of the Db2 database, (e.g. db2-database.xxxxxxx.us-east-1.rds.amazonaws.com)
• Port: The SQL port of the Db2 database, typically 50000.
• Username: The username of the service account you created in Step 1.
• Password: The password of the service account you created in Step 1.
• Database: The Db2 database name that Monte Carlo will monitor.

When you click Add, Monte Carlo will run a series of validations to ensure we are able to reach the Db2 database and have the permissions required to collect metadata. Validation failures will be surfaced so you can address them before trying again.

2b. Onboard Db2 Integration with SSL

Monte Carlo supports SSL encrypted connections to Db2 databases, including:

• Server certificate verification (one-way SSL) - validates the Db2 server's identity using a CA certificate

SSL configuration is supported via the command-line interface (CLI) for both creating new connections and updating existing ones.

📘

CLI Version Requirement

Db2 SSL support requires CLI version v0.153.0 or later.

You can find all available options for configuring a Db2 connection in the CLI documentation:

• add-db2 - Create a new Db2 connection with SSL
• update-db2 - Update an existing Db2 connection, including SSL configuration

You can update SSL settings for an existing Db2 connection using the update-db2 command. This is useful when:

• Enabling SSL on a connection that was previously created without SSL
• Updating certificates (e.g., when certificates expire or are rotated)
• Disabling SSL on a connection

⚠️

Important: Port Requirements

Db2 uses different ports for SSL and non-SSL connections:

• Port 50000: Standard TCP port for non-SSL connections
• Port 50001: Often used for SSL/TLS encrypted connections

When updating SSL settings, you must also update the port accordingly:

• Enabling SSL: Set port to 50001 (or other configured SSL port)
• Disabling SSL: Set port to 50000

Example Commands

Enable SSL on an existing connection:

montecarlo integrations update-db2 \
  --connection-id <connection-uuid> \
  --ssl-ca /path/to/ca.pem \
  --port 50001

Disable SSL:

montecarlo integrations update-db2 \
  --connection-id <connection-uuid> \
  --ssl-disabled=true \
  --port 50000

Excluded Schemas

The following system created schemas are excluded from our metadata collection:

• SYSIBM
• SYSCAT
• SYSFUN
• SYSSTAT
• SYSPROC
• SYSIBMADM
• SYSIBMINTERNAL
• SYSIBMTS
• SYSPUBLIC
• NULLID
• SQLJ
• SYSTOOLS

FAQs

Which platforms are supported by the Db2 integration?

Monte Carlo currently supports Db2 for LUW (Linux, UNIX and Windows).

How can I validate Monte Carlo has access to my assets?

After completing the Db2 integration setup, your Db2 assets should appear in the Monte Carlo Assets page between a few minutes and one hour. If you don't see your assets after this time period, you can run a validation test to troubleshoot the connection:

1. Navigate to Settings → Integrations
2. Find your Db2 integration and click on it
3. Select the specific connection you want to test
4. Click the Test button from the connection menu

This validation test will help identify any configuration issues that might be preventing your assets from appearing.

When running the validation test, you should see all green checkmarks. If any errors are encountered, the system will provide specific steps to resolve them.