NetworkLens may be configured to use several different reporting agents.
E-Mail notification is handled by a reporting agent named "lens-mail". It can be configured to run out of cron at the interval desired by the user. It scans all of the defined user-created queries stored in the LENS_QUERY table and checks to see if there are new and/or modified events that match each query. If there are events, and the user has selected to be notified via e-mail, then an e-mail will be generated for that user with a list of matching events for the query.
For more information, refer to the E-Mail Notification Reporting Agent Source Code included in the appendix.