I have 3.14.14-gentoo x64, syslog-ng 3.4.8, Snoopy 2.4.0. syslog had default config, I added:
rebooted system since snoopy install, restarted syslog daemon past config modification, cr8ed auth.log with 777 temporarily even tho 600 should be enough owned by root:root(same as messages). snoopy works and keep writing to "messages", but under no means I seem to be able to make him log execv(e) to auth.log. Any advices would be appreciated.

Did you also include this destination in a syslog-ng log path?

Yea, thank you very much for a pointer. For those who might be searching for it in future, I'll just post working & self-explanatory block example to save them syslog-ng manual rummaging time:

source src { system(); internal(); };

log { source(src); destination(console_all); };

destination messages { file("/var/log/messages"); };
filter f_src { level(debug..emerg) and not program("snoopy"); };
log {
source(src);
filter(f_src);
destination(messages);
};

destination d_snoop { file("/var/log/auth.log"); };
filter f_snoop { program("snoopy"); };
log {
source(src);
filter(f_snoop);
destination(d_snoop);
};