What is stored in the /var directory?
/var holds data that grows and changes as the system runs — logs, caches, mail and print queues, databases — as opposed to the static program files elsewhere.
The filesystem is partly organised by how often things change, and /var is the "writes happen here constantly" bucket. That has a real consequence for administrators: /var needs writable, roomy storage and is the directory most likely to fill up the disk, because logs and queues accumulate. A full /var can stop services and even logins.
| Subdirectory | What collects there |
|---|---|
/var/log |
System and application logs (your first stop for debugging) |
/var/cache |
Cached data programs can rebuild |
/var/spool |
Queued jobs — print, mail, cron |
/var/lib |
Persistent state, e.g. databases, package DB |
/var/www |
Website files (on many distros) |
/var/tmp |
Temp files that do survive reboots |
Key test: if a file changes during normal operation, it belongs in /var. If it only changes when you install software, it belongs in /usr.
/var/tmp vs /tmp: both are temporary, but /tmp is wiped on reboot (often RAM-backed), while /var/tmp is on disk and survives reboots — use it for temp data that must outlive a restart but isn't permanent. (/var/tmp is cleaned on a longer ~30-day schedule.)
Mnemonic: var = variable data.
Go deeper:
Filesystem Hierarchy Standard 3.0 — Chapter 5 defines /var(log, cache, spool, lib, tmp) as variable data.