Since it is not working with the default criteria, then the best thing to do next is to run a rule engine trace while reproducing:
Rule Engine Tracing
-- the rule engine trace will at least answer the fundamental question of "does my test client even match on the desired rule criteria?"
Definitely open a ticket with support if you would like for us to analyze the traces, as it is not recommended to post such info here.....
Rule of engagement: Attachments
If I can make a comment - might be wrong but we have the same problem for which there is no real solution.
The Volume Quota for User or IP is recorded in quota.db, and records the size of the file After Download (using Body.Size).
Problem is ( using example) if the URL/file downloaded is 100 Megs and the Volume Quota is 10 megs, if when the IP started the download with a current Quota under 10 Megs (say 5 megs) then the file will be downloaded.
After the file is download then the Quota setting for this IP will be 105 Megs.
Thus you can set a Volume Quota of 1 Meg and still potentialy download 2 Gigs in a single day.
We have a work-around by having Daily, Weekly and Monthly Volume Quota settings - thus a heavy day is captured by Daily , Weekly, and Monthly settings - thus if little Johnie does download a 2 Gig file today with a 10 Meg Daily setting, he's out for the rest of the week/month. This is not perfect but helps.
Hope this is of assistance.