It also doesn't work in IDS 11.10, and it doesn't make any difference
if the "count" column alias is replaced with a non-reserved word.

I suggest you report this as a bug. In the interim, you could use a
temporary table:

   select remote_addr, count(distinct query_id) number
   from web_l_sentrylog
   group by remote_addr
   into temp temp_table with no log;

   select *
   from temp_table
   where number > 5;

   drop table temp_table;

Regards,
Doug Lawry