The following example can be used to catch unauthorized users attempting to rename or scratch system datasets. The event will be logged to a file named LOGSYSDS allocated as //LOGSYSDS DD SYSOUT=A in the DIF JCL and TSO user TSOU111 will be notified as well when the event occurs.
DEFRULE SYSDS
IF &ENVIRON = (SCRATCH,RENAME)
&HLQ = (SYS1,SYS2,SYSS*) OR
&QUAL2 = (SYS1,SYS2,SYS3)
&RUSER NE (SYS*,TECH*,IBMUSER)
THEN ISSUE WRITEMSG(MSGSYSDS)
DEFMSG MSGSYSDS
“*** &RUSER &JOBNAME ATTEMPT TO &ENV &DSNAME”
LOG(LOGSYSDS) USERID(TSOU111)