trying to filter how roles are applied, I want to apply the sub role to everything except certain machines by ip address or by name.. and its not working. This should be simple, what am I missing here??

I either want to do this by hostname or ip address, Ip would be better, but I cannot make either one work..

the rule as I read it, should be as follows, apply this role if the 8443 port is open and the hostname does not contain the string "tool"

do I have this wrong?? or does this just not work..

the hostname is netapp-tool.domain.com. I have tried netapp-tool, netapp, tool, netapp-tool.domain.com. none work, the role keeps getting applied to the host.