I have now tested this combination on centos 7, and collecting local log messages do seem to work for me.
Please note that syslog-ng will detect whether it is running under systemd at runtime, and it does it this way:
```
if (lstat("/run/systemd/system/", &st) < 0 || !S_ISDIR(st.st_mode))
```
e.g. it is checking whether /run/systemd/system is a directory. If it is, the system() source will use systemd-journal() as its source. If this does not exist, it will fall back to /dev/log.
syslog-ng would report the result of this check with a debug level message:
```
msg_debug("Systemd is not detected as the running init system");
```
or
```
msg_debug("Systemd is detected as the running init system");
```
The program destination stuff should really be independent of the init system, but a different AppArmor/SELinux config might be the culprit though. When you launch it from the console, it would be unconfined, but with systemd, a policy might be applied that does NOT allow executing external programs.
I hope this helps.