Db2 is one of IBM's most audited products, and not because customers deploy it carelessly. It is because the licensing is genuinely intricate. Db2 ships in multiple editions, can be licensed by two different metrics, and frequently arrives bundled inside other IBM software with rights that are narrower than teams assume. An audit pulls all three threads at once. Defending Db2 means knowing which edition runs where, which metric applies, and exactly how far any bundled entitlement extends.
Two metrics, several editions.
Db2 is most often licensed by Processor Value Unit, the same core-based metric used for WebSphere: PVU per core times the cores allocated to Db2, with sub-capacity available on eligible technology. Some editions and deployments are instead licensed by Authorized User Single Install, a per user metric with a minimum number of users required per core. Advanced, Standard and Workgroup editions carry different rights and different entitlement rules, so a deployment licensed correctly under one edition can be a finding under another. The first defensive step is always to establish which edition is actually installed on each server.
The bundling trap.
The most expensive Db2 surprises come from bundles. Db2 is included with several IBM products, for example as the database under a Cognos or other middleware offering, but the bundled entitlement is restricted to supporting that host product. Using the bundled Db2 as a general purpose database for other applications steps outside the grant and creates a separate, fully chargeable Db2 deployment. Teams rarely do this maliciously. An administrator simply points a new application at a database that is already running. Under audit, that is a clean finding.
Where Db2 audits find exposure.
The recurring problem areas are predictable once the structure is clear:
- Edition mismatch. A higher edition installed where a lower one is entitled, or features used that the licensed edition does not include.
- Bundled Db2 used out of scope. A database that shipped with another product serving applications it was never licensed to support.
- Authorized User minimums. Per core user minimums not met, so the licensable user count is higher than the head count suggests.
- Sub-capacity gaps. The same tooling failures that hit any PVU product, defaulting Db2 to full-capacity charging.
A Db2 finding usually rests on edition, bundling or metric confusion rather than raw over deployment. The buyer side response is an edition by edition reconciliation: what is installed, which metric governs it, and how far each bundled entitlement extends. In a representative manufacturing matter spanning WebSphere and Db2, a methodology challenge backed by clean evidence cut the claim by 71 percent.
The buyer side defense.
Defending Db2 under audit starts by containing the data request, then independently mapping every install to its edition, metric and entitlement before IBM completes its own count. Bundled deployments are checked against the scope of the host product, Authorized User minimums are calculated correctly, and any sub-capacity denial is met with the tooling record. Genuine gaps are confined to the precise deployment and period, and the corrected position is written into the settlement alongside a forward plan that keeps editions and bundles within their grants.