Captive Portal Auth not remote logging 26.03.1

Irondude

I have about a dozen if 3100's in use. I have upgraded all but 1 to the latest, 25.11.1 to 26.03.1(missed it luckily). They will log Portal Auth's to the local log but will not send logs to the remote log service. I enabled other logs for remote and they do send data to the remote syslog service, just not the Portal Auth. The 1 router with 25.11.1 still functions correclty, sending Portal Auth logs.
I do know 26.03 had problems with Portal Auth logs, 26.03.1 was supposed to correct this. Was this just local or remote or both? Anyone sending Portal Auth logs to remote syslog successfully?

Thanks

Gertjan

@Irondude

pfSense Plus 26.03.1 : my remote syslog server :

Local :

Works for me.

but .... I have in place this single 'syslog' patch :

diff --git a/src/etc/inc/syslog.inc b/src/etc/inc/syslog.inc
index b2031974e8..cd4019afab 100644
--- a/src/etc/inc/syslog.inc
+++ b/src/etc/inc/syslog.inc
@@ -418,7 +418,7 @@ EOD;
         $syslogconf .= system_syslogd_get_remote_servers($syslogcfg, "*.{$log_level_filter}");
     }

-    $syslogconf .= "!logportalauth\n";
+    $syslogconf .= "!*\n:msg, startswith, \"INFO [" . LOG_PREFIX_CAPTIVEPORTAL . "] logportalauth: \"\n";
     $log_level_portalauth = '*';
     if (!$local_logs_disabled) {
         $syslogconf .= "*.{$log_level_portalauth}                                 {$g['varlog_path']}/portalauth.log\n";
@@ -426,6 +426,7 @@ EOD;
     if (!$remote_log_all && array_path_enabled($syslogcfg, '', 'portalauth')) {
         $syslogconf .= system_syslogd_get_remote_servers($syslogcfg, "*.{$log_level_portalauth}");
     }
+    $syslogconf .= ":*\n";

     $log_level_vpn = $log_level_default ?: '*';
     $log_level_nginx = $log_level_default ?: '*';

( get the patch from the redmine page ! )

I think, while upgrading to 26.03.1, the patcher reversed the correction (the update present in 26.03.1), so know I have to unpatch the patch with this patch. Something like that.

Irondude

Follow up:
i have re-imaged to 25.11.1 on my 2100's and 3100's and restored the config.
the Captive Portal Auth logging to remote syslog server resumed as normal. As a test, I upgraded a 2100 to latest, 26.03.1, the logging to remote syslog failed, local still works. I then reverted back to 25.11.1, the remote syslog then resumed as normal. Is this still and bug in 26.03.1 or something in my config causing this? The only option I have enabled for remote syslog is Captive Portal events. When I enable other options to be syslogged they are received at syslog server.
Thanks

Gertjan

@Irondude

I'm using 26.03.1 myself.
Remote syslogging with this option :

and that works fine.
Maybe partial logging has an issue ?