# /var
**/var** holds variable data: files whose content grows and changes during normal system operation. Log files, mail spools, package manager caches, lock files, and runtime state all live here. Separating this from `/usr` (which is largely static after install) makes it practical to mount `/usr` read-only and to size partitions appropriately — `/var` needs room to grow, `/usr` does not.

```
/var/log/           log files written by the kernel and system services
/var/log/syslog     general system log (Debian/Ubuntu)
/var/log/auth.log   authentication events: logins, sudo, SSH
/var/log/nginx/     web server access and error logs
/var/cache/         cached data that can be regenerated if deleted
/var/cache/apt/     downloaded .deb packages (safe to clear with apt clean)
/var/lib/           persistent state for applications and services
/var/lib/dpkg/      dpkg's database of installed packages
/var/lib/postgresql/ PostgreSQL data files
/var/spool/         queued work awaiting processing
/var/spool/cron/    per-user crontabs
/var/spool/mail/    incoming mail before delivery to user mailboxes
/var/tmp/           temporary files that persist across reboots (unlike /tmp)
/var/run/           runtime data: PID files, Unix domain sockets
```

`/var/log` fills up silently and is a common cause of full-disk failures on production systems. **logrotate** manages this: it compresses and archives old log files on a schedule, keeping the total log size bounded. The configuration in `/etc/logrotate.d/` specifies rotation frequency, retention count, and post-rotation actions (such as sending `SIGHUP` to reload a daemon's log file descriptor).

`/var/run` is typically a tmpfs, cleared on every boot. Daemons write their PID files here so init systems and monitoring tools can check whether a service is running without executing it.