diff --git a/blockauth b/blockauth
index 3849b15..a98ceba 100755
--- a/blockauth
+++ b/blockauth
@@ -121,7 +121,6 @@ while [ ${blockauth} -eq 0 ] ; do
     echo "blockauth: allowing access for ${user}" >> ${filelog} 
     sed -i "s/Failed password for ${user} from/blockauth\[allowed\]\: invalid pass for ${user} from/g" /var/log/auth.log
     sed -i "s/Failed password for invalid user ${user} from/blockauth\[allowed\]\: invalid pass for ${user} from/g" /var/log/auth.log
-    systemctl restart rsyslog &> /dev/null
   done
   # Reset blocklist when maximum is reached
   num_blocklist=$(cat ${blocklist} | wc -l)
@@ -140,6 +139,7 @@ while [ ${blockauth} -eq 0 ] ; do
   sort -u ${blocklist}.temp > ${blocklist}
   rm -rf ${blocklist}.temp
   sed -i 's/Failed password for/blockauth\[blocked\]\: invalid pass for/g' /var/log/auth.log
+  systemctl restart rsyslog &> /dev/null
   # Exclude allowed IPs
   if [ -z "${always_ip_allowed}" ] ; then
     echo "blockauth: running exclude allowed ips"