What is the process you used and I'll check it on another build.
Did you just add the below to your local.rules file?
alert ( msg: "ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK"; sid: 4; gid: 112; rev: 1; metadata: rule-type preproc ; classtype:bad-unknown; )
Did you use something to generate the alert?