Very strange - do you have any other rules that use Agent Online events?
This would be weird and is a long shot, but one place you can look is under Manage > Appliances, then click the gear on the left next to your appliance and do Policy. Navigate through Internal Alert -> Internal Info -> Internal Agent Online and make sure the box next to "Rules" is checked like this:
