What Goes In /var? – Linux

The /var directory in Linux is used to store files that are expected to change or grow in size during the normal operation of the system. The name “var” stands for “variable,” and it typically contains logs, spool files, caches, and other data that changes over time. Below are common subdirectories found within /var and their purposes:

Common Subdirectories in /var

1. /var/log
   • Stores system and application log files.
   • Examples:
     • /var/log/syslog or /var/log/messages (general system logs)
     • /var/log/auth.log (authentication logs)
     • /var/log/dpkg.log (package management logs)
2. /var/tmp
   • Contains temporary files that need to persist between reboots.
   • Similar to /tmp but with less frequent cleanup.
3. /var/spool
   • Contains data waiting to be processed.
   • Examples:
     • /var/spool/mail or /var/spool/postfix (email queues)
     • /var/spool/cron (cron job data)
4. /var/cache
   • Stores cached application data to improve performance.
   • Examples:
     • Package manager caches (e.g., /var/cache/apt for Debian-based systems)
     • Application-specific cache files.
5. /var/lib
   • Holds persistent state information for programs.
   • Examples:
     • /var/lib/dpkg (Debian package database)
     • /var/lib/mysql (MySQL database files)
6. /var/run (or /run in newer systems)
   • Contains runtime information such as PID files and socket files.
   • Examples:
     • /var/run/sshd.pid (PID file for the SSH daemon)
     • /var/run/network (network-related runtime data)
7. /var/lock
   • Holds lock files to prevent multiple processes from accessing a resource simultaneously.
8. /var/www
   • Stores web server files (e.g., for Apache or Nginx).
   • This is often the root directory for hosted websites.
9. /var/crash
   • Contains crash reports and core dumps.
10. /var/log/journal (optional)
    • Used by systemd for persistent journal logs if configured.

Key Characteristics of /var:

• Files in /var are typically writable by system processes.
• These files can grow in size; thus, /var is often placed on a separate partition to prevent it from filling up the root filesystem.
• Administrators should monitor and manage disk space in /var regularly.