That rule looks like it'd work. Are you seeing the events in LEM (look at the "General Change Management" filter)? What source accounts are being logged?
Also, can you check the time on the LEM? If you SSH into the LEM, go to APPLIANCE, run DATECONFIG and then press ENTER without entering any information 4 times. Is the date, time and timezone correct? If not, rerun the command and fix it.
Have you clicked the "Activate Rules" button in the GUI?