Set the appropriate working directory on RHEL systems

attributes/default.rb

@@ -58,6 +58,7 @@ default['rsyslog']['modules']                   = %w(imuxsock imklog)
 # platform family specific attributes
 case node['platform_family']
 when 'rhel'
+  default['rsyslog']['working_dir'] = '/var/lib/rsyslog'
   # format { facility => destination }
   default['rsyslog']['default_facility_logs'] = {
     '*.info;mail.none;authpriv.none;cron.none' => "#{node['rsyslog']['default_log_dir']}/messages",