/var holds variable data: files whose content grows and changes during normal system operation. Log files, mail spools, package manager caches, lock files, and runtime state all live here. Separating this from /usr (which is largely static after install) makes it practical to mount /usr read-only and to size partitions appropriately — /var needs room to grow, /usr does not.

/var/log/           log files written by the kernel and system services
/var/log/syslog     general system log (Debian/Ubuntu)
/var/log/auth.log   authentication events: logins, sudo, SSH
/var/log/nginx/     web server access and error logs
/var/cache/         cached data that can be regenerated if deleted
/var/cache/apt/     downloaded .deb packages (safe to clear with apt clean)
/var/lib/           persistent state for applications and services
/var/lib/dpkg/      dpkg's database of installed packages
/var/lib/postgresql/ PostgreSQL data files
/var/spool/         queued work awaiting processing
/var/spool/cron/    per-user crontabs
/var/spool/mail/    incoming mail before delivery to user mailboxes
/var/tmp/           temporary files that persist across reboots (unlike /tmp)
/var/run/           runtime data: PID files, Unix domain sockets

/var/log fills up silently and is a common cause of full-disk failures on production systems. logrotate manages this: it compresses and archives old log files on a schedule, keeping the total log size bounded. The configuration in /etc/logrotate.d/ specifies rotation frequency, retention count, and post-rotation actions (such as sending SIGHUP to reload a daemon's log file descriptor).

/var/run is typically a tmpfs, cleared on every boot. Daemons write their PID files here so init systems and monitoring tools can check whether a service is running without executing it.