In this case syslog-ng was reading logs from a directory. The number of logs exceeded the max-open file limitation for syslog-ng on the system.
The soft limit for open files was set to 4096 which is the default. This limit can be increased for syslog-ng.
When syslog-ng starts it opens all log files, so the "--fd-limit" (default: 4096) parameter has to be calculated to be larger than the number of log files.
You can check what the ulimit is set to by running "cat /proc/xxxx/limits" where xxxx is the PID of syslog-ng.
A hard limit is the maximum allowed set by root. A soft limit is the effective value right now.
Edit the following file:
ExecStart=/opt/syslog-ng/sbin/syslog-ng -F --enable-core $SYSLOGNG_OPTIONS
Increase to 8192:
ExecStart=/opt/syslog-ng/sbin/syslog-ng -F --enable-core --fd-limit 8192 $SYSLOGNG_OPTIONS
Restart the daemon, for example:
systemctl reload syslog-ng.service
Increase the file limits that Syslog-ng is allowed to open in the kernel: