/var

data that changes as the system runs

/var holds the files that keep changing. The name is short for variable. Logs grow, caches fill, mail and print jobs queue up — all of it here, so that the rest of the system can stay still while this part moves.

When something went wrong, the record of it is in /var/log.

Holds

Changing data

Logs, caches, databases, queues

On disk

Yes

Often its own partition on servers

Who writes

Services

Each under its own account

Name

Variable

Its contents never stop changing

Why it exists

Every directory at the top of the tree is there for a reason. This is the problem /var solves.

Growth kept in one place

Logs can fill a disk. On its own partition, a full /var stops the logging but leaves the root filesystem with room to boot and be repaired.

Lets /usr stay read-only

Programs live in /usr and never write there. Anything they need to save while running goes to /var instead.

What you find inside

Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.

/var

logdirectorySystem and service logs. The first place to look when something fails.
libdirectoryState that services keep between restarts, including databases.
cachedirectoryData that can be regenerated, such as downloaded packages.
spooldirectoryJobs waiting to be handled: mail, printing, scheduled tasks.
wwwdirectoryThe default web root on many distributions.
tmpdirectoryTemporary files that are kept across a reboot.

At the terminal

Four commands that show what this directory is doing on a real machine.

sudo tail -f /var/log/syslog

Watch the system log as new lines arrive. Fedora-family systems use /var/log/messages.

sudo du -sh /var/* | sort -h

Find which part of /var is taking the space.

journalctl -u ssh --since today

Read one service’s log entries from systemd’s journal.

ls -lt /var/log | head

List the logs most recently written to.

Handle with care

What goes wrong here, and what someone securing or attacking the machine looks at.

Watch it for space

A full /var stops services that cannot write their logs or data. Log rotation normally prevents this; a runaway log is the usual cause when it does not.

Logs are evidence

auth.log records every login and sudo use. Attackers try to edit or delete it, which is why important servers send their logs to another machine as well.

Read alongside

/etcSystem-wide configuration, kept as plain text files./tmpTemporary files. Any user may write here; nothing is expected to last./srvData this host serves to others, such as a web site or file share.