hmm, you (or, rather, the firewall boys) do understand there are two rules needed, yes? One for the connection in one direction itself, the second for the acknowledgements back to the client. Maybe this point is moot but i have seen many things in my life and this wouldn't be the strangest.

Have you made sure the name of the target system is a FQDN? Does the AIX system have proper name resolution for the target? You might, for testing purposes, put the IP address directly there and/or put the host name of the logging server into /etc/hosts.

Also notice that syslog needs reverse lookup too, which is often "forgotten" by novice network admins. If you check the name resolution always try the nslookup not only for the hostname but also for the corresponding IP address. Both have to be successful.

How is syslog started? Do a

Code:

lssrc -ls syslogd

and post the output. You can use the chssys command to change the way syslogd is started by the system resource controller. See the man page for syslogd for specifics, especially the -d (debug) switch. Also notice that after every change to /etc/syslog.conf you need to restart the subsystem with

Code:

stopsrc -s syslogd ; sleep 2 ; startsrc -s syslogd

(the stopping, starting and sleeping is just my paranoia, probably a refresh -s syslog would suffice)

I hope this helps.

bakunin