Comment # 1 on bug 948584 from Christian Boltz

If my wild guess on the mailinglist (#include <abstractions/openssl>) doesn't
work, please switch the AppArmor profile to complain mode, then restart and use
syslog-ng. After that, please provide the logfile so that I can update the
profile.

In detail:
  aa-complain /etc/apparmor.d/sbin.syslog-ng
  systemctl start syslog-ng.service
  # wait some minutes to make sure some things get logged
  systemctl restart syslog-ng.service  # just to make sure restart works

Then get the AppArmor log events, which can be in
- /var/log/audit/audit.log if auditd is running
- /var/log/messages - grep for apparmor
and attach the log to this bugreport.

You can adjust the profile yourself (using aa-logprof or $EDITOR), but I'm
interested in the log nevertheless.

When you have an updated profile, set it back to enforce mode using
aa-enforce /etc/apparmor.d/sbin.syslog-ng