Email alert from Syslog Viewer?

I believe if you have specified criteria for both the message type and message pattern then both criteria have to match for any given message.  If you are looking for the word "rejected" in the message pattern then try removing it from the message type criteria.

I've done what you said and it is better, however I only get one email.  When then event with the word "rejected" appears it shows up 5 times in the syslog viewer, but I don't get 5 emails, just 1 email which is the last of the 5.  I need them all to be emailed.

Do you have anything configured on the Trigger Threshold tab for the alert?

No, this is greyed out.  It always emails the last syslog message out of the 5, but the work "rejected" appears on all 5.

Is it safe to assume that all five messages are coming from the same source?  Also, how about the possibility that there is another alert configured that is interfering?

Gonzo,

Please open a support ticket and reference this thwack post.

-Craig