/var is the FHS location for variable data—files that change during the normal operation of the system, as opposed to the relatively static binaries and configuration elsewhere. It is where logs accumulate (/var/log/), packages cache downloaded files (/var/cache/apt/archives/), databases store their data (/var/lib/postgresql/), mail queues line up (/var/mail/, /var/spool/mail/), and print jobs wait (/var/spool/cups/).
Because /var grows, runs full, and gets hot on disk, it is sometimes placed on its own partition or filesystem. This prevents a runaway log or overflowing spool from filling the root filesystem and preventing the system from booting. On containerised systems /var/lib/docker/ or /var/lib/containers/ can easily become the largest directory on the host as image layers accumulate.
Key subdirectories include:
/var/log/— system and application logs/var/cache/— non-essential cached data that can be regenerated/var/lib/— persistent state of installed packages/var/spool/— queued work: mail, print, cron/var/tmp/— temporary files that should survive reboot (unlike/tmp)/var/run/— historically runtime data, now usually a symlink to/run/
A good habit on any long-running Linux machine is occasional disk-usage inspection of /var with du -sh /var/* to find what is quietly consuming space.
Related terms: Filesystem Hierarchy Standard, /run
Discussed in:
- Chapter 4: The Filesystem Hierarchy — /var — Variable Data
Also defined in: Textbook of Linux