/var

/var is the FHS location for variable data: files that change during the normal operation of the system, as opposed to the relatively static binaries and configuration elsewhere. It is where logs accumulate (/var/log/), packages cache downloaded files (/var/cache/apt/archives/), databases store their data (/var/lib/postgresql/), mail queues line up (/var/mail/, /var/spool/mail/), and print jobs wait (/var/spool/cups/).

Because /var grows, runs full, and gets hot on disk, it is sometimes placed on its own partition or filesystem. This prevents a runaway log or overflowing spool from filling the root filesystem and preventing the system from booting. On containerised systems /var/lib/docker/ or /var/lib/containers/ can easily become the largest directory on the host as image layers accumulate.

Key subdirectories include:

• /var/log/: system and application logs
• /var/cache/: non-essential cached data that can be regenerated
• /var/lib/: persistent state of installed packages
• /var/spool/: queued work (mail, print, cron)
• /var/tmp/: temporary files that should survive reboot (unlike /tmp)
• /var/run/: historically runtime data, now usually a symlink to /run/

A good habit on any long-running Linux machine is occasional disk-usage inspection of /var with du -sh /var/* to find what is quietly consuming space.