A process that collects and analyzes data from computer mainframe system events and/or messages as they occur, utilizing a System Management Facility (SMF) interface, a SubSystem Interface (SSI), an Event Notification Facility (ENF) interface, and generates alert message(s) when installation-developed rules so indicate, to provide real-time mainframe event and message monitoring, with notification to multiple targets based on either of two factors: a) configuration parameters defined by auditors and security administrators, and b) statistical analysis and correlation of historical event data (profiling).