Hi all,

Question on TL/SP compatibility best practices for AIX 7.2/7.3.

We're building an on-prem security scanner for AIX. The core is Go, but we ship a C dependency (YARA) as part of it. We're trying to decide how to structure build/test environments to maximize compatibility across TL/SP levels.

 • If we build on an older TL/SP (baseline), is it generally safe to expect it to run on newer TL/SP within the same AIX major version?
 • Conversely, if we build on a newer TL/SP, how often do you see binaries fail on older TL/SP due to runtime/library differences?
 • Is "build on oldest supported TL/SP, test on oldest + current" the usual approach?

Example oslevel strings we currently see in IBM Cloud:
 • AIX 7.3: 7300-03-00-2446
 • AIX 7.2: 7200-05-11-2546

Any gotchas around linking (static vs dynamic) or common library mismatches would be helpful.

------------------------------
Florian Roth
CTO
Nextron Systems
Frankfurt
------------------------------

I think AIX binary compatibility will help you here - if you build on the oldest TL you support you should be fine on newer TL/SP levels, and IBM's docs explain this here: https://www.ibm.com/docs/en/aix/7.3.0?topic=aix-binary-compatibility and the restrictions here: https://www.ibm.com/docs/en/aix/7.3.0?topic=compatibility-restrictions-aix-binary.

------------------------------
Chris Gibson
------------------------------

Thanks, I'll check the links.

------------------------------
Florian Roth
CTO
Nextron Systems
Frankfurt
------------------------------

Original Message:
Sent: Wed April 01, 2026 01:02 AM
From: Chris Gibson
Subject: Best practice for TL/SP coverage when building AIX binaries

I think AIX binary compatibility will help you here - if you build on the oldest TL you support you should be fine on newer TL/SP levels, and IBM's docs explain this here: https://www.ibm.com/docs/en/aix/7.3.0?topic=aix-binary-compatibility and the restrictions here: https://www.ibm.com/docs/en/aix/7.3.0?topic=compatibility-restrictions-aix-binary.

------------------------------
Chris Gibson
------------------------------

>  • If we build on an older TL/SP (baseline), is it generally safe to expect it to run on newer TL/SP within the same AIX major version?

As Chris pointed - yes. I have binaries built on AIX 5.3 20 years ago, and they are still running on AIX 7.3 without any modifications. The main point here is to understand the restrictions. Another thing that might cause problems with compatibility is the compiler you use. If you use gcc, then you have libgcc as a dependency, and there are too many different versions of it. I had a program compiled with gcc 2.9.5 on AIX 4.3, I think. Somewhere at the end of the 90s. It worked without big problems on AIX 7.2 30 years later, but libgcc 2.9.5 had to be installed on the system. It didn't work with newer libgcc versions. My recommendation - use IBM's "classic" XL C/C++ compiler if you need compatibility with older AIX versions. If you plan to work only with the latest AIX 7.2 TL5 and AIX 7.3, then you can use the IBM OpenXL compiler, which is clang-based and more "Linux-compatible".

> Conversely, if we build on a newer TL/SP, how often do you see binaries fail on older TL/SP due to runtime/library differences?

It can happen and happened to me. I prefer to build on older versions.

>  • Is "build on oldest supported TL/SP, test on oldest + current" the usual approach?

Yes, or build on oldest possible TL/SP and test on the current, or what you must support.

------------------------------
Andrey Klyachkin

https://www.power-devops.com
------------------------------

Thanks Andrey, very helpful reply. The point about compiler choice and libgcc dependencies is especially useful, because that's exactly one of the things I was a bit worried about. Good to hear your recommendation so clearly points toward building on the oldest supported level and testing on newer ones. That sounds like the safest route for us.

------------------------------
Florian Roth
CTO
Nextron Systems
Frankfurt
------------------------------

Original Message:
Sent: Wed April 01, 2026 03:22 AM
From: Andrey Klyachkin
Subject: Best practice for TL/SP coverage when building AIX binaries

>  • If we build on an older TL/SP (baseline), is it generally safe to expect it to run on newer TL/SP within the same AIX major version?

As Chris pointed - yes. I have binaries built on AIX 5.3 20 years ago, and they are still running on AIX 7.3 without any modifications. The main point here is to understand the restrictions. Another thing that might cause problems with compatibility is the compiler you use. If you use gcc, then you have libgcc as a dependency, and there are too many different versions of it. I had a program compiled with gcc 2.9.5 on AIX 4.3, I think. Somewhere at the end of the 90s. It worked without big problems on AIX 7.2 30 years later, but libgcc 2.9.5 had to be installed on the system. It didn't work with newer libgcc versions. My recommendation - use IBM's "classic" XL C/C++ compiler if you need compatibility with older AIX versions. If you plan to work only with the latest AIX 7.2 TL5 and AIX 7.3, then you can use the IBM OpenXL compiler, which is clang-based and more "Linux-compatible".

> Conversely, if we build on a newer TL/SP, how often do you see binaries fail on older TL/SP due to runtime/library differences?

It can happen and happened to me. I prefer to build on older versions.

>  • Is "build on oldest supported TL/SP, test on oldest + current" the usual approach?

Yes, or build on oldest possible TL/SP and test on the current, or what you must support.

------------------------------
Andrey Klyachkin

https://www.power-devops.com
------------------------------

As Chris has said, AIX has good binary compatibility when moving forward to new TLs, SPs and major AIX releases.

A year of so ago we took a backup of an AIX 4.3.3 system, with it's application and upgraded it, though multiple steps, to 7.2 and the application works!  This as an out of support application from the 1990s running on a current in support AIX level.  This is now running in production for our client.

Phill.

------------------------------
Phill Rowbottom
Unix Consultant
Service Express
Bedford
------------------------------

I'd just like to expand on "Conversely, if we build on a newer TL/SP, how often do you see binaries fail on older TL/SP due to runtime/library differences?" (the other points are sufficiently covered)

Often enough that you don't want to touch this with the proverbial 10ft pole.  Very simple applications that touch stable and a limited set of functions will sometimes be able to travel back, but more complex applications that touch a wider set of functions will almost never be able to run on previous versions.  64 bit apps will definitely be unable to cross from 5.1 to 4.3.

Back when 5.3 was new, some madlad wrote a guide on how to compile on 5.3 to target 4.1, this involved copying 4.1 libraries to the 5.3, and a chroot environment.  This was totally a "hold my beer" moment that you don't want anywhere near production.

------------------------------
José Pina Coelho
IT Specialist at Kyndryl
------------------------------

From my nmon and njmon experience, I would just compile to the latest AIX 7.3 TL and sp or one version back if you don't want to upgrade every time.

 - Of course, avoid any new functions and features, such as those delivered in a recent TL.

 - A decade ago, the libperfstat library was improved for every TL = a nightmare, if you wanted the newer stats. But now it has been stable for many years, so a single binary covers AIX 7.1, 7.2, and 7.3.

 - For the VIOS, I have to create a different binary as the VIOS has extra virtual resource functions. If I include these, the program does not run on "pure" AIX because it detects missing VIOS functions at startup.

Then run a quick test on older AIX releases. If there is a problem, your program will probably fail to start at all due to library mismatches. If it starts up, it will probably work fine.

For njmon The AIX 7.3 binary runs fine on AIX 7.2.

Users will prefer one binary that works on AIX 7.2 and AIX 7.3 - so only have two binaries, if you are forced to.

No need to have a security scanner program for AIX 7.1 or older.

 - If the user is running these releases, then they do not care about security at all! :-)

I compile with the latest GCC compiler from the open source toolbox - it saves all that mucking around with licenses.

If you need extreme performance, then the more advanced compilers might help or might not.

I hope this helps, N

------------------------------
Nigel Griffiths - IBM retired
London, UK
@mr_nmon
------------------------------

Thanks, very useful perspective. Good point as well about keeping the number of binaries low.

------------------------------
Florian Roth
CTO
Nextron Systems
Frankfurt
------------------------------

Original Message:
Sent: Fri April 03, 2026 07:02 AM
From: Nigel Griffiths
Subject: Best practice for TL/SP coverage when building AIX binaries

From my nmon and njmon experience, I would just compile to the latest AIX 7.3 TL and sp or one version back if you don't want to upgrade every time.

 - Of course, avoid any new functions and features, such as those delivered in a recent TL.

 - A decade ago, the libperfstat library was improved for every TL = a nightmare, if you wanted the newer stats. But now it has been stable for many years, so a single binary covers AIX 7.1, 7.2, and 7.3.

 - For the VIOS, I have to create a different binary as the VIOS has extra virtual resource functions. If I include these, the program does not run on "pure" AIX because it detects missing VIOS functions at startup.

Then run a quick test on older AIX releases. If there is a problem, your program will probably fail to start at all due to library mismatches. If it starts up, it will probably work fine.

For njmon The AIX 7.3 binary runs fine on AIX 7.2.

Users will prefer one binary that works on AIX 7.2 and AIX 7.3 - so only have two binaries, if you are forced to.

No need to have a security scanner program for AIX 7.1 or older.

 - If the user is running these releases, then they do not care about security at all! :-)

I compile with the latest GCC compiler from the open source toolbox - it saves all that mucking around with licenses.

If you need extreme performance, then the more advanced compilers might help or might not.

I hope this helps, N

------------------------------
Nigel Griffiths - IBM retired
London, UK
@mr_nmon
------------------------------