If security is enabled, the trigger monitor will run under the userid that submitted the JCL to start the trigger monitor.