Based on what you shared, your setup looks correct for enabling syslog forwarding over UDP. There are a few things to confirm to make sure the updates you made take effect.

1. If you haven't already done so, restart the container service to ensure the port mapping takes effect. You can use the following commands:

sudo systemctl daemon-reexecsudo systemctl daemon-reloadsudo systemctl restart podman-lme-fleet-server.service

2. You will also need to check for any port conflicts to ensure nothing (like rsyslog) is already bound to UDP 514. If that's the case, you can have rsyslog receive on 514 and forward to an alternate UDP port that the container can listen on (e.g., 1514).

3. Confirm traffic is hitting the host withsudo tcpdump -i any port 514

Let us know what you see and if you run into anymore issues.

The tcpdump you ran was still checking port 514 and not 1514. Can you trysudo tcpdump -i any port 1514 and see if that works?