To support ImageMode correctly, the /var/lib/rsyslog directory (including its permissions and ownership) should be declared in a tmpfiles.d entry. This ensures that the directory is automatically created on boot by systemd-tmpfiles.

The directory /var/lib/rsyslog is used as the default WorkDirectory by Rsyslog. This directory is essential for the core features, including state files, queue files, most importantly for crash recovery.