I was going through your requirement and that seems to be an important notification. If we look at the ACS 5.4 guide > under logging categories. It does talk about ACS operational changes—Logs all operations requested by administrators, including promoting an ACS from your deployment as the primary, requesting a full replication, performing software downloads, doing a backup or restore, generating and restoring PACs, and so on.
Administrative and operational audit log messages are always sent to the local store, and you can also send them to remote syslog server and Monitoring and Reports server targets.
Log messages are sent to the local store with this syslog message format:
time stamp sequence_num msg_code msg_sev msg_class msg_text attr=value
Since you've configured ACS logging categories to log everything. It should work fine. Can you see the same message success or failure under local store logs of ACS. If we can see it there it means ACS is sending it, after that we can check in the log forwarder file and run the packet capture on the syslog server.