DLP not logging, but stopping applications writing to removable storage

Thread continued from here:

http://community.sophos.com/t5/Sophos-Endpoint-Security-and/Possible-Bug/m-p/19271#M7764

So all my VM's are stored on a removable disk, and i was getting an error: VERR_ACCESS_DENIED from VirtualBox, but no event logs from Sophos? Should it be logging?

Also the Credit Card rule was set to Allow transfer on acceptance by user and log event.

Does this mean the user should be prompted by Sophos to continue?

Jeffrey