To conclude: restart of syslog.socket service was needed. That is the one responsible for creating the socket. BTW shouldn't enabling of some syslog service (like rsyslog) enable the ForwardToSyslog journald option?