diff --git a/docs/shared_parsers_catalog/ls_var_lib_rsyslog.rst b/docs/shared_parsers_catalog/ls_var_lib_rsyslog.rst
new file mode 100644
index 0000000000..abad60b550
--- /dev/null
+++ b/docs/shared_parsers_catalog/ls_var_lib_rsyslog.rst
@@ -0,0 +1,3 @@
+.. automodule:: insights.parsers.ls_var_lib_rsyslog
+   :members:
+   :show-inheritance:
diff --git a/insights/parsers/ls_var_lib_rsyslog.py b/insights/parsers/ls_var_lib_rsyslog.py
new file mode 100644
index 0000000000..4bec296b4a
--- /dev/null
+++ b/insights/parsers/ls_var_lib_rsyslog.py
@@ -0,0 +1,29 @@
+"""
+LsVarLibRsyslog - command ``ls -lZ  /var/lib/rsyslog``
+======================================================
+"""
+
+
+from insights.core import CommandParser, FileListing
+from insights.core.plugins import parser
+from insights.specs import Specs
+
+
+@parser(Specs.ls_var_lib_rsyslog)
+class LsVarLibRsyslog(CommandParser, FileListing):
+    """
+    Parses output of ``ls -lZ  /var/lib/rsyslog`` command.
+
+    Sample output::
+
+        total 4
+        -rw-------. 1 root root system_u:object_r:syslogd_var_lib_t:s0 127 Nov 30 03:40 imjournal.state
+
+    Examples:
+        >>> rsyslog_obj.dir_contains('/var/lib/rsyslog', 'imjournal.state')
+        True
+        >>> imjournal_entry = rsyslog_obj.dir_entry('/var/lib/rsyslog', 'imjournal.state')
+        >>> imjournal_entry['se_type']
+        'syslogd_var_lib_t'
+    """
+    pass
diff --git a/insights/specs/__init__.py b/insights/specs/__init__.py
index 89277d3a46..3bf2db3cba 100644
--- a/insights/specs/__init__.py
+++ b/insights/specs/__init__.py
@@ -341,6 +341,7 @@ class Specs(SpecSet):
     ls_var_lib_mongodb = RegistryPoint()
     ls_var_lib_nova_instances = RegistryPoint()
     ls_var_lib_pcp = RegistryPoint()
+    ls_var_lib_rsyslog = RegistryPoint()
     ls_var_log = RegistryPoint()
     ls_var_opt_mssql = RegistryPoint()
     ls_var_opt_mssql_log = RegistryPoint()
diff --git a/insights/specs/default.py b/insights/specs/default.py
index 8db853d60a..3f98d6147b 100644
--- a/insights/specs/default.py
+++ b/insights/specs/default.py
@@ -331,6 +331,7 @@ class DefaultSpecs(Specs):
     ls_var_lib_mongodb = simple_command("/bin/ls -la /var/lib/mongodb")
     ls_var_lib_nova_instances = simple_command("/bin/ls -laRZ /var/lib/nova/instances")
     ls_var_lib_pcp = simple_command("/bin/ls -la /var/lib/pcp")
+    ls_var_lib_rsyslog = simple_command("/bin/ls -lZ /var/lib/rsyslog")
     ls_var_log = simple_command("/bin/ls -la /var/log /var/log/audit")
     ls_var_opt_mssql = simple_command("/bin/ls -ld /var/opt/mssql")
     ls_var_opt_mssql_log = simple_command("/bin/ls -la /var/opt/mssql/log")
diff --git a/insights/specs/insights_archive.py b/insights/specs/insights_archive.py
index cf78f373c0..a085cd256b 100644
--- a/insights/specs/insights_archive.py
+++ b/insights/specs/insights_archive.py
@@ -136,6 +136,7 @@ class InsightsArchiveSpecs(Specs):
     ls_var_lib_mongodb = simple_file("insights_commands/ls_-la_.var.lib.mongodb")
     ls_var_lib_nova_instances = simple_file("insights_commands/ls_-laRZ_.var.lib.nova.instances")
     ls_var_lib_pcp = simple_file("insights_commands/ls_-la_.var.lib.pcp")
+    ls_var_lib_rsyslog = simple_file("insights_commands/ls_-lZ_.var.lib.rsyslog")
     ls_var_log = simple_file("insights_commands/ls_-la_.var.log_.var.log.audit")
     ls_var_opt_mssql = simple_file("insights_commands/ls_-ld_.var.opt.mssql")
     ls_var_opt_mssql_log = simple_file("insights_commands/ls_-la_.var.opt.mssql.log")
diff --git a/insights/tests/parsers/test_ls_var_lib_rsyslog.py b/insights/tests/parsers/test_ls_var_lib_rsyslog.py
new file mode 100644
index 0000000000..1e668fffff
--- /dev/null
+++ b/insights/tests/parsers/test_ls_var_lib_rsyslog.py
@@ -0,0 +1,32 @@
+import doctest
+
+from insights.parsers import ls_var_lib_rsyslog
+from insights.tests import context_wrap
+
+
+LS_VAR_LIB_RSYSLOG_1 = """
+total 4
+-rw-------. 1 root root system_u:object_r:syslogd_var_lib_t:s0 127 Nov 30 03:40 imjournal.state
+"""
+
+LS_VAR_LIB_RSYSLOG_2 = """
+total 4
+-rw-------. root root system_u:object_r:syslogd_var_lib_t:s0 imjournal.state
+"""
+
+
+def test_ls_var_lib_rsyslog():
+    rsyslog_obj = ls_var_lib_rsyslog.LsVarLibRsyslog(context_wrap(LS_VAR_LIB_RSYSLOG_2, path="insights_commands/ls_-lZ_.var.lib.rsyslog"))
+    assert rsyslog_obj.files_of('/var/lib/rsyslog') == ['imjournal.state']
+    journal_obj = rsyslog_obj.dir_entry('/var/lib/rsyslog', 'imjournal.state')
+    assert journal_obj is not None
+    assert journal_obj['se_type'] == 'syslogd_var_lib_t'
+    assert journal_obj['owner'] == 'root'
+
+
+def test_ls_var_lib_pcp_doc_examples():
+    env = {
+        'rsyslog_obj': ls_var_lib_rsyslog.LsVarLibRsyslog(context_wrap(LS_VAR_LIB_RSYSLOG_1, path="insights_commands/ls_-lZ_.var.lib.rsyslog")),
+    }
+    failed, total = doctest.testmod(ls_var_lib_rsyslog, globs=env)
+    assert failed == 0