Description of problem:
syslog-ng, as packaged in EPEL-7, is not especially systemd aware; nor is it particularly SELinux-aware. It attempts to unlink/relink /dev/log on start, which has several failure conditions.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. install C7 or RHEL7
1.1: set SElinux to targeted/enforcing
2. configure auditd to to use audisp syslog plugin
3. start auditd
4. install syslog-ng from EPEL
5. start syslog-ng (system() in this case will use /dev/log)
systemctl: syslog-ng will fail to start, being unable to unlink/relink /dev/log
shell: syslog-ng -f /etc/syslog-ng/syslog-ng.conf: audisp will not be able to use the recreated /dev/log, as its in the wrong context.
syslog-ng 3.8.1 from the copr-be.cloud.fedoraproject.org handles this case better.
recommend up-revving to syslog 3.8.1 or greater, as 3.5.6 is broken.