I migrated this filter rule from KSS legacy, and there are a couple issues with it in NG. I'm looking for syslog messages where DOT1X failed, but want to exclude them if the client mac starts with 0010.49, 0800.0f, or 1400.e9 (Mitel phones). This worked like a charm in legacy, but the multiple entries under the Exclude field are not working as intended in NG.
This is the first issue. There is another issue with this same rule, but I think it might be worth another thread since it is related to the Action and not the Filter.