I have a java application using log4j SyslogAppender (facility=USER) and I can see using tcpdump on port 514 that my application is sending intended log message as a datagra
Remote logging was not enabled in syslog. Weird, because it still opens and listens on 514. Once I started with syslog -r, everything started logging.