Q:

syslog-ng starts and runs fine manually... starts but doesnt create logs when using systemd

Redhat 7.6 with latest syslog-ng (3.22)
ive searched and tried all the old remedies. Nothing has worked to resolve this.
My syslog-ng.conf file has a bunch of ports and a bunch of destinations. When something comes in on the port, it creates logs and folders of the destination. Simple.
If I do this from CLI as root:
/usr/sbin/syslog-ng -F --cfgfile /etc/syslog-ng/syslog-ng.conf --control /var/lib/syslog-ng/syslog-ng.ctl --persist-file /var/lib/syslog-ng/syslog-ng.persist --pidfile /var/run/syslog-ng.pid

Everything works. I can watch my log folder and see logs being made. No problem.
ps -ef |grep syslog 
shows
root      7179  7166  0 17:15 pts/1    00:00:00 /usr/sbin/syslog-ng -F --cfgfile /etc/syslog-ng/syslog-ng.conf --control /var/lib/syslog-ng/syslog-ng.ctl --persist-file /var/lib/syslog-ng/syslog-ng.persist --pidfile /var/run/syslog-ng.pid

HOWEVER
If I run it like this (and when system starts): 
systemctl start syslog-ng

Everything appears to work.
ps -ef|grep syslog
shows
root      7434     1  0 17:22 ?        00:00:00 /usr/sbin/syslog-ng -F --cfgfile /etc/syslog-ng/syslog-ng.conf --control /var/lib/syslog-ng/syslog-ng.ctl --persist-file /var/lib/syslog-ng/syslog-ng.persist --pidfile /var/run/syslog-ng.pid

The only difference that when run from systemd, no logs get created. I have no idea what could be causing this. Netstats shows its still listening on all of the ports. 
journalctl -eu syslog-ng shows:
Aug 27 17:22:32 system-new systemd[1]: Starting System Logger Daemon...
Aug 27 17:22:32 system-new systemd[1]: Started System Logger Daemon.

UPDATE 1 as per comment:

not an selinux issue (all ports needed have been allowed)
same goes for firewall
never looked at audit log but pasted latest stop and then start below (nothing goes into audit log when I run manually)
I didn't try or not try to use Journald - whatever is enabled by default. I did try uncommenting ForwardToSyslog=yes in the config as per a search result I found. It made no difference.
also keep in mind when thinking about firewall rules etc and port issues... it DOES work when running manually, which means firewall isn't really the issue

AUDIT LOG
type=SERVICE_STOP msg=audit(1566960199.893:2253): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=syslog-ng comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

type=SERVICE_START msg=audit(1566960207.896:2263): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=syslog-ng comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

ps -efZ -systemctl
system_u:system_r:syslogd_t:s0  root      3207     1  0 19:03 ?        00:00:00 /usr/lib/systemd/systemd-journald
system_u:system_r:syslogd_t:s0  root      9499     1  0 20:31 ?        00:00:00 /usr/sbin/syslog-ng -F --cfgfile /etc/syslog-ng/syslog-ng.conf --control /var/lib/syslog-ng/syslog-ng.ctl --persist-file /var/lib/syslog-ng/syslog-ng.persist --pidfile /var/run/syslog-ng.pid

ps -efZ -manual run
system_u:system_r:syslogd_t:s0  root      3207     1  0 19:03 ?        00:00:00 /usr/lib/systemd/systemd-journald
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 9543 1  0 20:34 ? 00:00:00 supervising syslog-ng
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 9544 9543  0 20:34 ? 00:00:00 /usr/sbin/syslog-ng --cfgfile /etc/syslog-ng/syslog-ng.conf --control /var/lib/syslog-ng/syslog-ng.ctl --persist-file /var/lib/syslog-ng/syslog-ng.persist --pidfile /var/r$

Netstat
systemctl
tcp        0      0 0.0.0.0:10001           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10002           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10003           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10004           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10101           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10005           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10006           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10007           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10008           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10009           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10201           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10202           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10010           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10011           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10203           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10012           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10013           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10301           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10014           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10015           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10016           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10017           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10018           0.0.0.0:*               LISTEN      9645/syslog-ng
tcp        0      0 0.0.0.0:10019           0.0.0.0:*               LISTEN      9645/syslog-ng
udp        0      0 0.0.0.0:514             0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10001           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10002           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10003           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10004           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10005           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10006           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10007           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10008           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10009           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10010           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10011           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10012           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10013           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10014           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10015           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10016           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10017           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10018           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10019           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10101           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10201           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10202           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10203           0.0.0.0:*                           9645/syslog-ng
udp        0      0 0.0.0.0:10301           0.0.0.0:*                           9645/syslog-ng

manual run
tcp        0      0 0.0.0.0:10001           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10002           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10003           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10004           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10101           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10005           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10006           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10007           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10008           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10009           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10201           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10202           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10010           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10011           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10203           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10012           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10013           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10301           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10014           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10015           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10016           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10017           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10018           0.0.0.0:*               LISTEN      9544/syslog-ng
tcp        0      0 0.0.0.0:10019           0.0.0.0:*               LISTEN      9544/syslog-ng
udp        0      0 0.0.0.0:514             0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10001           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10002           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10003           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10004           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10005           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10006           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10007           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10008           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10009           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10010           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10011           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10012           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10013           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10014           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10015           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10016           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10017           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10018           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10019           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10101           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10201           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10202           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10203           0.0.0.0:*                           9544/syslog-ng
udp        0      0 0.0.0.0:10301           0.0.0.0:*                           9544/syslog-ng

UPDATE 2 Audit log grep for syslogd_t
type=SYSCALL msg=audit(1566959653.640:2104): arch=c000003e syscall=83 success=no exit=-13 a0=212b2b0 a1=1ed a2=ffffffffffffdcc0 a3=7ffd07da1a34 items=0 ppid=1 pid=9499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/usr/sbin/syslog-ng" subj=system_u:system_r:syslogd_t:s0 key=(null)

type=AVC msg=audit(1566959663.651:2105): avc:  denied  { write } for  pid=9499 comm="syslog-ng" name="log_collection" dev="dm-5" ino=35651585 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

type=SYSCALL msg=audit(1566959663.651:2105): arch=c000003e syscall=83 success=no exit=-13 a0=212b2b0 a1=1ed a2=ffffffffffffdcc0 a3=7ffd07da1a34 items=0 ppid=1 pid=9499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/usr/sbin/syslog-ng" subj=system_u:system_r:syslogd_t:s0 key=(null)

A:

What you're experiencing is an SELinux problem.
RHEL and its relatives (CentOS, Fedora) typically ship with SELinux enabled.
SELinux supports programmable policies that can be customized or replaced. By default, RHEL/CentOS/Fedora use the targeted policy, which is a policy that doesn't limit all processes (your shell and whatever you start from it will be run with the unconfined_t type) but it does apply restrictions to some targeted daemons, of which syslog daemons (be it sysklogd, rsyslog, syslog-ng and journald) are included.
SELinux applies types to processes (that you can inspect with ps -Z) and to files/directories (which you can see with ls -Z).
It will set rules such that when a process of a specific type executes a binary of another type, the resulting process will run under that type. That's how systemd (running under init_t) spawns syslog-ng (binary with type syslogd_exec_t) will spawn a process running under syslogd_t (but if you run it directly, you get unconfined_t, as you've seen.)
Next, the policy defines what a process running under syslogd_t can and can not do. More specifically, a syslog daemon is expected to only write logs, so the SELinux policy defaults to only allow it to write to /var/log an nowhere else in the filesystem. (That way, if your syslog daemon is compromised, an attacker won't be able to use it to overwrite system binaries, as SELinux will prevent it from writing to those.)
The way this is handled is, again, through SELinux types. The /var/log directory has a var_log_t type and the policy only allows syslog to write to a directory with that type.
If you want syslog to write logs somewhere else, you should label that other location with the same type.
In your case, that location is /data/log_collection.
In order to set the label of /data/log_collection as var_log_t, you can use the chcon command.
But what you actually want to do is to make that a permanent configuration, so that this directory will always keep that context even if the filesystem is relabeled.
You can set that configuration with:
$ sudo semanage fcontext -a -t var_log_t '/data/log_collection(/.*)?'

This command will update SELinux files under /etc/selinux/targeted/contexts/files/. It uses a regular expression for the path, in order to match the directory itself and any files under it.
And then apply it with:
$ sudo restorecon -R -v /data/log_collection

For more details, see SELinux Contexts — Labeling Files at Red Hat Documentation Portal.

