Maybe it can help,

In the SYS.Database Class you can find the IsSystemDB(Directory) method that returns whether it is a system database.
It works on Caché and IRIS.

Documentation IsSystemDB - IRIS

Documentation IsSystemDB - Caché

Examples:

%SYS>set databaseDir = ##class(Config.Databases).Open("IRISLIB").Directory

%SYS>write ##class(SYS.Database).IsSystemDB(databaseDir)
1

%SYS>set databaseDir = ##class(Config.Databases).Open("CACHELIB").Directory

%SYS>write ##class(SYS.Database).IsSystemDB(databaseDir)
1

You can create User Events using the Security.Events class, with the Create method.

Example:

This process is related to the Caché System Monitor. Monitors various resources, including the Journal.

"Caché System Monitor is a flexible, user-extensible utility used to monitor a Caché instance and generate notifications when the values of one or more of a wide range of metrics indicate a potential problem."

You can Stop them or customize the Sampling Interval for your environment.

See more in the documentation Caché System Monitor  and Caché Monitor

You can try to change using Config.SQL class.

Example:
 

%SYS>w $SYSTEM.SQL.CurrentSettings()
ODBC VARCHAR Max Length:                     4096 (Default)

%SYS>do ##class(Config.SQL).Get(.p)
%SYS>zw p("ODBCVarcharMaxlen")
p("ODBCVarcharMaxlen")=4096

%SYS>set p("ODBCVarcharMaxlen") = 5120
%SYS>do ##class(Config.SQL).Modify(.p)

%SYS>w $SYSTEM.SQL.CurrentSettings()
ODBC VARCHAR Max Length:                     5120

Another suggestion,

If you use an exclusive Resource in your database (example %DB_<database-name>), you can use it as a reference. It is included in the .DAT and you can check it even with the database not created, just the physical file.

Example:

w ##class(SYS.Database).%OpenId("/usr/irissys/mgr/test1/").ResourceName

The SYS.Database class also gets other information, but nothing relevant for identification.

--

Or (perhaps not recommended) you can extract the original path directly from the .DAT, for example:

$ strings /usr/irissys/mgr/test2/IRIS.DAT | head -3
Cache DB
/usr/irissys/mgr/test1/
%DB_TEST1

You can review the 'UnknownUser' user's permissions. In the documentation it says that 'Embedded SQL' does not check permissions:

InterSystems SQL enforces privilege checking for ODBC, JDBC, Dynamic SQL, and the SQL Shell interface on InterSystems IRIS data platform. Embedded SQL statements do not perform privilege checking;

Or use an authenticated user with the proper permissions;

About privileges and users: Users, Roles, and Privileges

About authentication: Authentication and Authorization

I'm using Zabbix to monitor all IRIS status and it works great. Zabbix has alert features (Triggers) that communicate with me via email or communication channels (like slack) when an incident occurs. I collect status information, errors, performance, etc. I use SNMP protocol indicators and other indicators through ODBC, some created by me and others obtained through monitor collections.

You can try this using EmergencyId mode. Stop IRIS and start with the parameter:

Linux

iris start IRIS EmergencyId=user,password

Windows

iris start IRIS /EmergencyId=user,password

User and password can be anything. This will be used for login.

Once logged in as this user by the terminal, you can use the ^SECURITY routine in the %SYS namespace to change the password of _SYSTEM.

Documentation (Temporary):

EmergencyId Mode

^SECURITY

In Caché I use this:

set path = ##class(Config.Databases).Open("USER").Directory

set database = ##class(SYS.Database).%OpenId($get(path))

do database.DisableJournaling()
set status = database.%Save()

do database.EnableJournaling()
set status = database.%Save()