Starting with version 2.91, the ability to match strings without using wildcards is no longer available, and all text matching needs to use wildcard characters if the filter text does not fully match the event text (e.g. source, category, event message, ...). This will not affect most installations, but users that have the wildcard functionality disabled in version 2.90 or earlier (it was enabled by default) will need to review their configuration and make adaptations.

Please see the table below for examples on how existing filters might have to be modified. The "Source Text" column shows the text to match, whereas the middle column shows how this text could have been matched in version 2.90 earlier with the wildcard feature disabled. The "2.91" column shows how a text like this would have to be matched in 2.91. Note that wildcards are only necessary for partial matches, not for full matches.

Source Text

Without Wildcard Support (2.90 and earlier only)

2.91

Microsoft-Windows-Security-Auditing

Microsoft-Windows

Microsoft-Windows*

Microsoft-Windows-Security-Auditing

Microsoft-Windows-Security-Auditing

Microsoft-Windows-Security-Auditing

Microsoft-Windows-Security-Auditing

Windows-Security

*Windows-Security*