bahall

Glad I could help. Thanks for posting the source of the problem. It's nice to know the original cause for future troubleshooting.

So after playing around a bit, I understand your issue. I don't think that directory service groups in LEM support mail as there are no email addresses directly associated in LEM. However, if this is a distribution group, or if you can create a distribution group, you can create a workaround by creating a user as a contact…

If you go to the Explore-nDepth menu, you can search for the event "InternalRuleFired". This will give you a list of each time one of your rules fired. You can compare the time stamp with that on the email.

From my understanding, in order to send an email to an address, that address has to be added as a contact under the "Build-Users" menu. It will not send to a group unless the group is a distribution group with an email address listed in the LEM users.

Typically this will be true. The InsertionIP field indicates the machine that generated the event, and the computer that the user attempted to log on to should generate the event. However in practice, I would probably use the destinationIP field instead.

Have you managed to resolve this yet? Which rule was the culprit?

I have had the same issue from time to time. It seems to happen when the manager gets flooded with events that trigger an email alerts. I wonder if it is a bug that occurs if the manager can not keep up in sending email with the events. Check the subject on the message to see if it is tied to one of the existing rules.