I would still look at Logs (my real suggestion; this was a likely guess, not a suggested solution without knowing more about your specifics), as that will show you what was really happening and how to address the issue with the way your rule was written compared to the way your device reports.
In any case, glad you have something working at least for now! Certainly revisit the above if that changes.
