This is by design and entirely expected since you're using TCP to talk to your syslog server. The command reference for the logging command has the following:
---------------------------------------------------
Troubleshooting
If you are using TCP as the logging transport protocol, the PIX Firewall stops passing traffic as a security measure if any of the following error conditions occur: the PIX Firewall is unable to reach the syslog server; the syslog server is misconfigured (such as with PFSS, for example); or the disk is full. (UDP-based logging does not prevent the PIX Firewall from passing traffic if the syslog server fails.)
To enable the PIX Firewall to pass traffic again, do the following:
Step 1 Identify and correct the syslog server connectivity, misconfiguration, or disk space error condition.
Step 2 Enter the command logging host inside 10.1.1.1 tcp/1468 to enable the logging again.
Alternately, you can change the logging to default logging on UDP/514 by issuing the command logging host inside 10.1.1.1. UDP-based logging passes traffic even if the syslog server fails.
---------------------------------------------------
This is by design and one of the security features of the PIX. Basically, if you're serious enough about using TCP for your syslogging, then if the PIX can't log it, don't allow it through. If you don't want this feature, just use UDP for your syslogging and you won't run into this problem. The following commands should do the trick for you:
no logging host inside 10.1.1.3 6/1470
logging host inside 10.1.1.3
Of course make sure your syslog server is set up to accept messages received via UDP.
