ACE WAF XML Gateway 6.1.1 - arbitrarily monitoring and filtering

Question

Can someone explain why the ACE XML Gateway is monitoring some events and filtering others, when they are the same events?
I have all mParamAll System Command injection signtatures in monitor mode on the firewall profile that is applied to both of the web applications in the two incidents below, but the firewall sometimes monitors one and sometimes blocks the other. They are both the same and should both be monitored only.
Please help.
May 10 2011 08:09:25.603 PM W Matched signature SysCommandInj_m.rm via rule CommandInject.mParamAll in request from ##.###.53.80 for application 'XXX XXX'. Match was in REQUEST_POSTPARAM['__EVENTVALIDATION'], which had value /wEWlwEC6<stripped for size>1sQICoMD1. Request path was: /Kview/CustomCodeBehind/base/courseware/classroom/. Create Exemption (monitor mode) FD0A320100001868DB87435D3D7F9AB0 FBIVAWAP reactor /waf/incident
May 10 2011 02:13:27.037 PM W Matched signature SysCommandInj_m.tclsh via rule CommandInject.mParamAll in request from ##.###.53.80 for application 'YYYYY YYY'. Match was in REQUEST_POSTPARAM['__VIEWSTATE'], which had value mQjXnQ<stripped for size>laPxd3C8+. Request path was: /XXXX/ApprovalConsole.aspx. Create Exemption FD0A320100001866DA415B3C3D7F9964 FBIVAWAP reactor /waf/incident

Answer 1

Anyone?
It looks like multiple ip addresses can be configured through the console, is this all that is required? Do I need to setup listening ports for these new ip addresses or how do I get the WAF to proxy for multiple "virtual ip addresses"?
Thank you,
Jim