Novell Home

My Favorites

Close

Please to see your favorites.

The correlation rule email action is not working.

This document (7013097) is provided subject to the disclaimer at the end of this document.

Environment

NetIQ Sentinel 7.x Correlation Server

Situation

A correlation rule was created to fire on a particular event and then execute an email action. The correlation rule fires but the email action is not executed.
 
The following error is appearing multiple times in the server0.0.log
 
Thu Aug 22 13:38:48 EDT 2013|SEVERE|pool-30-thread-1|esecurity.ccs.comp.script.executor.JavaScriptExecutor.execute
 ; Exception JavaException: java.lang.IllegalArgumentException: Error sending email: No recipients specified. (/var/opt/novell/sentinel/data/server.cache/javascript_action_plugins/Send_EMail_751929F21936102B8518001321B5C0B3_254939542167378675/main.script#277); org.mozilla.javascript.JavaScriptException;
Thu Aug 22 13:38:48 EDT 2013|SEVERE|pool-30-thread-2|esecurity.ccs.comp.script.executor.JavaScriptExecutor.execute
 ; Exception JavaException: java.lang.IllegalArgumentException: Error sending email: No recipients specified. (/var/opt/novell/sentinel/data/server.cache/javascript_action_plugins/Send_EMail_751929F21936102B8518001321B5C0B3_
254939542167378675/main.script#277);
 
The email action has been tested outside of correlation and worked successfully.

Resolution

The correlation rule should be configured to fire after a particular count or to execute the email to "perform actions at most every" 1 minute, 5 minutes, etc.   Not "perform action everytime the rule fires".

Cause

The error in the server0.0.log is somewhat misleading for this particular situation because there are recipients specified to recieve emails and the email action was tested to confirm the recipient recieved an email.
 
In this situation the correlation rule was misconfigured.  The rule was set to fire every time an event occurred, however said event occurred many times per minute\second which in turn would try to send an email action.   This resulted in more email actions than the system could handle.

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7013097
  • Creation Date:23-AUG-13
  • Modified Date:29-AUG-13
    • NetIQSentinel

Did this document solve your problem? Provide Feedback