pfSense » pfSense Plus

diff --git a/src/etc/inc/syslog.inc b/src/etc/inc/syslog.inc
index b2031974e8..cd4019afab 100644
--- a/src/etc/inc/syslog.inc
+++ b/src/etc/inc/syslog.inc
@@ -418,7 +418,7 @@ EOD;
         $syslogconf .= system_syslogd_get_remote_servers($syslogcfg, "*.{$log_level_filter}");
     }

-    $syslogconf .= "!logportalauth\n";
+    $syslogconf .= "!*\n:msg, startswith, \"INFO [" . LOG_PREFIX_CAPTIVEPORTAL . "] logportalauth: \"\n";
     $log_level_portalauth = '*';
     if (!$local_logs_disabled) {
         $syslogconf .= "*.{$log_level_portalauth}                                 {$g['varlog_path']}/portalauth.log\n";
@@ -426,6 +426,7 @@ EOD;
     if (!$remote_log_all && array_path_enabled($syslogcfg, '', 'portalauth')) {
         $syslogconf .= system_syslogd_get_remote_servers($syslogcfg, "*.{$log_level_portalauth}");
     }
+    $syslogconf .= ":*\n";

     $log_level_vpn = $log_level_default ?: '*';
     $log_level_nginx = $log_level_default ?: '*';