Last xx syslog messages

Question

In 9.5 there is apparently another way of doing filters. This used to work:

(ip like 'nn.nn.nn.*') and (message not like '*10.nn.nn.n*') and (message not like '*xntpd*') and (message not like '*last message repeated*')

Now it claims that

The "Last xx Syslog Messages" resource threw an exception..
RunQuery failed, check fault information.

Now, what would be the correct syntax? And why change this between releases?

aLTeReGo · Answer

I just ran into this same problem with the exact same error message using the filter (IP = '10.1.2.3'). This appears to be a 9.5 bug.

btp · Answer

Don't quite know what you are referring to. This is in the web view, last xx syslog messages. No radio button there? Anyhow - (hostname not like 'erx*') works.

lchance · Answer

Is the bullet checked which says USE REGULAR EXPRESSIONS IN THIS RULE ? If so, that means that "LIKE" won't be used.

It may be that the update caused these to become automatically checked (or turned on). I've seen other strange things like this happen to me as well after an update.