I set the setting to 3 but found out some logs were not writing any more so wnted to do more research on which user needs the rights to write to LOG_AUTH (for example). So based on the docs reverting should be easy:
If you want to revert RESTRICT_SYSLOG to another option and disable this
feature, change the setting of RESTRICT_SYSLOG and then restart lfd and then
syslog/rsyslog and the unix sockets will be reset
Unfortunatly settings werent reverted and setting it to 0 or 2 logwriting to certain files only honours the users within /etc/csf/csf.syslogusers.
Im hoping somebody else also has this problem and perhaps resolved it?!