Syslog message format question

You are missing a colon at the front of ommail.

if $msg regexp 'snort[[0-9]]: [[0-9]:[0-9]:[0-9]].*' then :ommail:;mailBody

I cannot speak for the accuracy of your RegEx, but you can try 'contains' rather than 'regex' and try a simpler test to narrow the problem if it persists beyond the syntax mentioned above.

I would also recommend increasing $ActionExecOnlyOnceEveryInterval after sorting things out.

I'd say the best reliable option at this point (exluding comerial software solutions) is pure syslog-ng