I have a java application using log4j SyslogAppender (facility=USER) and I can see using tcpdump on port 514 that my application is sending intended log message as a datagra
Remote logging was not enabled in syslog. Weird, because it still opens and listens on 514. Once I started with syslog -r, everything started logging.
Maybe this will help: http://wiki.loggly.com/log4j
It's just an example set up with using SyslogAppender. Just ignore the part about forwarding it to Loggly.