Z/OS

z/OS
Company type	Proprietary software
Industry	Operating systems
Predecessor	OS/390
Founded	October 2000; 26 years ago
Founder	IBM
Products	z/OS operating system
Owner	IBM
Website	www.ibm.com/it-infrastructure/z/os

z/OS is a 64-bit operating system created by IBM specifically for z/Architecture mainframe systems, first released in October 2000. It serves as the successor to OS/390 and continues the evolution of the MVS family, integrating numerous related components—some optional—into a cohesive environment. z/OS blends advanced operating system capabilities with broad backward compatibility, allowing it to support legacy applications dating back to the 1960s alongside modern workloads.

Major characteristics

z/OS provides support for established mainframe technologies such as CICS, COBOL, IMS, PL/I, IBM Db2, RACF, SNA, IBM MQ, record-oriented data access methods, as well as scripting languages and utilities like REXX, CLIST, SMP/E, JCL, TSO/E, and ISPF.

The system incorporates a 64-bit Java runtime environment, a C/C++ compiler based on LLVM Clang, and UNIX APIs through UNIX System Services—recognized as a certified UNIX operating system by The Open Group. Support for hierarchical file systems (HFS and zFS) enables z/OS to execute a wide array of commercial and open-source applications. Its networking stack includes TCP/IP with IPv6, HTTP servers derived from Lotus and Apache, SSH, FTP, NFS, and CIFS/SMB protocols. Designed to deliver high quality of service (QoS), z/OS features Parallel Sysplex clustering technology that enhances scalability and fault tolerance.

Workload management is handled by the Workload Manager (WLM) and dispatcher, which automatically allocate resources across simultaneous tasks running in protected address spaces with dynamically adjustable performance objectives, facilitating multi-tenant operation within one OS instance. Additional virtualization support is provided through Logical Partitions (LPARs) and the optional z/VM hypervisor.

From its initial release, z/OS has supported tri-modal addressing modes (24-, 31-, and 64-bit). Up through Version 1.5, it could boot in either 31-bit ESA/390 or 64-bit z/Architecture mode; however, support for older platforms was discontinued in 2007. Presently, z/OS operates solely on z/Architecture mainframes using 64-bit addressing. IBM continues to uphold tri-modal backward compatibility for applications, although many middleware solutions like DB2 Version 8 now mandate 64-bit addressing.

IBM positions z/OS as its premier operating system engineered for continuous, high-throughput environments that require stringent security and reliability.

The software is offered under traditional licensing models as well as more cost-effective alternatives such as IBM Z New Application License Charges (zNALC) and IBM Z Solution Edition aimed at newer workloads. In the United States, pricing begins at approximately US$125 per month for the smallest zNALC configuration including support and commonly selected optional features.

With the advent of Variable Workload License Charges (VWLC) and Entry Workload License Charges (EWLC), customers benefit from sub-capacity billing—paying only for peak monthly usage instead of full machine capacity as was the case with OS/390. These pricing schemes apply to most IBM software running on z/OS with individual peak usage calculations capped by the overall z/OS peak. Qualification requires operation in 64-bit mode on z/Architecture hardware, removal of legacy OS/390 components, and monthly sub-capacity reporting to IBM. This sub-capacity pricing model substantially reduces software expenses for mainframe users. Further discounts are available through Advanced Workload License Charges (AWLC) and Entry Advanced Workload License Charges (EAWLC) on newer mainframe platforms like the zEnterprise 196 and zEnterprise 114.

Support for 64-bit Memory

z/OS accommodates 64-bit addressing for both virtual and physical memory spaces. Generally, data—rather than executable code—is positioned beyond the 2 GB threshold within each address space, mainly to optimize performance. Nevertheless, IBM has recently enabled Java applications on z/OS to run above this boundary.

Beginning with z/OS version 2 release 3, executing code beyond the 2 GB limit is allowed, although only a limited number of z/OS services currently support calls originating from that memory region.

Memory allocation occurs in units called "Large Memory Objects," sized in increments of 1 MB, and is categorized into three types:

Unshared – accessible exclusively by the address space that created it.
Shared – accessible to designated additional address spaces.
Common – accessible system-wide by all address spaces (introduced in z/OS Release 10).

z/OS Encryption Readiness Technology (zERT)

Introduced in z/OS V2R3 within the Communications Server, zERT provides monitoring, recording, and reporting of cryptographic protections applied to network traffic.

zERT Discovery

The TCP/IP stack gathers and reports encryption-related attributes for IPv4 and IPv6 connections secured through TLS/SSL, SSH, and IPSec protocols. This connection-level information is captured in SMF 119 subtype 11 records for subsequent evaluation.

zERT Aggregation

To efficiently handle extensive quantities of SMF 119 subtype 11 records, zERT aggregation condenses security session details into SMF 119 subtype 12 records at each SMF interval. This summarization preserves essential security data while significantly reducing record volume.

IBM zERT Network Analyzer

The IBM zERT Network Analyzer, included with the z/OS Management Facility (z/OSMF), offers a web-based graphical interface enabling network security administrators to examine and report on zERT summary records. Administrators can load SMF zERT summary data into a Db2 for z/OS database and execute tailored queries to evaluate network security posture.

Collection and Analysis of Operational Data

Data generated by z/OS systems provides insights into system status and aids in detecting performance or availability challenges. IBM Z Operational Log and Data Analytics alongside IBM Z Anomaly Analytics with Watson gather, interpret, and deliver actionable intelligence from this operational data.

IBM Z Operational Log and Data Analytics converts operational inputs from z/OS into streams compatible with third-party analytics solutions such as Elastic Stack and Splunk or directs them to its proprietary analysis platform for visualization and troubleshooting.

IBM Z Anomaly Analytics with Watson leverages historical IBM Z metrics and logs to establish baseline behavior models, then analyzes live data streams to identify anomalies, alerting IT operations about possible business-impacting incidents.

Types of Operational Data

IBM Z Operational Log and Data Analytics processes both structured and unstructured operational inputs, including:

System Management Facilities (SMF) records
Various logs such as job logs, equipment failure logs (logrec), z/OS UNIX syslog entries, VSAM cluster logs, system logs (SYSLOG), Tivoli NetView messages, WebSphere Application Server HPEL logs, RMF Monitor III reports
Operational data generated by user applications

IBM Z Anomaly Analytics with Watson collects data from numerous IBM Z environments including Db2 for z/OS, CICS Transaction Server for z/OS, and IBM MQ for z/OS. Its primary data sources are:

System Management Facilities (SMF) records
The z/OS system log (SYSLOG)

Additional resources

External resources