I found my mistake. The "invalid password" is set to a level of "3" and that is below the level of "7" to send emails.
I added to the local_rules.xml for the invalid password rule
However, I have a different issue now, I added a new rule for "account lockout" based on the same format as "invalid password" but I cant get that to email?
I ran the logtest with the "account lockout" using a sample of the Zimbra log (showing an account lockout) and it shows the new rule but doesn't send out the email alert?