Description of problem:

There is a typo in rsyslog.conf

--- a/rsyslog.conf
+++ b/rsyslog.conf
@@ -67,7 +67,7 @@ local7.*                                                /var/l
 #
 # An on-disk queue is created for this action. If the remote host is
 # down, messages are spooled to disk and sent when it is up again.
-#$WorkDirectory /var/spppl/rsyslog # where to place spool files
+#$WorkDirectory /var/spool/rsyslog # where to place spool files
 #$ActionQueueFileName fwdRule1 # unique name prefix for spool files
 #$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
 #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

And rsyslog package is not including /var/spool/rsyslog dir.

--- a/rsyslog.spec
+++ b/rsyslog.spec
@@ -150,6 +150,7 @@ install -d -m 755 $RPM_BUILD_ROOT%{_initrddir}
 install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig
 install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
 install -d -m 700 $RPM_BUILD_ROOT%{rsyslog_pkidir}
+install -d -m 700 $RPM_BUILD_ROOT%{_var}/spool/rsyslog
 
 install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/rsyslog
 install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/rsyslog.conf
@@ -214,6 +215,7 @@ mv /var/lock/subsys/rsyslogd /var/lock/subsys/rsyslog
 %dir %{rsyslog_pkidir}
 %{_initrddir}/rsyslog
 %{_sbindir}/rsyslogd
+%{_var}/spool/rsyslog
 %{_mandir}/*/*
 
 %files mysql