The default syslog configuration is to only output severity info or higher to /var/log/messages. I expect this would by default output slow queries as well. However this is not happening. After investigation with journalctl -p X, we discovered that slow messages have a log level of INFO, but are posted to syslog with a severity of DEBUG (7). As a result, such messages do not appear in /var/log/messages.

The documentation still mentions all messages being printed with severity info, which is not correct: https://docs.mongodb.com/manual/reference/configuration-options/#mongodb-setting-auditLog.destination: "Audit messages have a syslog severity level of info and a facility level of user."