NetIQ Sentinel 7.x Correlation Server
A correlation rule was created to fire on a particular event and then execute an email action. The correlation rule fires but the email action is not executed.
The following error is appearing multiple times in the server0.0.log
The email action has been tested outside of correlation and worked successfully.
The correlation rule should be configured to fire after a particular count or to execute the email to "perform actions at most every" 1 minute, 5 minutes, etc. Not "perform action everytime the rule fires".
The error in the server0.0.log is somewhat misleading for this particular situation because there are recipients specified to recieve emails and the email action was tested to confirm the recipient recieved an email.
In this situation the correlation rule was misconfigured. The rule was set to fire every time an event occurred, however said event occurred many times per minute\second which in turn would try to send an email action. This resulted in more email actions than the system could handle.