Differences

This shows you the differences between two versions of the page.

--- path-var [February 24, 2026 at 22:24] – created yanevskiv
+++ path-var [June 13, 2026 at 03:13] (current) – created - external edit 127.0.0.1
@@ Line 1: / Line 1: @@
+# /var
+**/var** holds variable data: files whose content grows and changes during normal system operation. Log files, mail spools, package manager caches, lock files, and runtime state all live here. Separating this from `/usr` (which is largely static after install) makes it practical to mount `/usr` read-only and to size partitions appropriately — `/var` needs room to grow, `/usr` does not.
+```
+/var/log/           log files written by the kernel and system services
+/var/log/syslog     general system log (Debian/Ubuntu)
+/var/log/auth.log   authentication events: logins, sudo, SSH
+/var/log/nginx/     web server access and error logs
+/var/cache/         cached data that can be regenerated if deleted
+/var/cache/apt/     downloaded .deb packages (safe to clear with apt clean)
+/var/lib/           persistent state for applications and services
+/var/lib/dpkg/      dpkg's database of installed packages
+/var/lib/postgresql/ PostgreSQL data files
+/var/spool/         queued work awaiting processing
+/var/spool/cron/    per-user crontabs
+/var/spool/mail/    incoming mail before delivery to user mailboxes
+/var/tmp/           temporary files that persist across reboots (unlike /tmp)
+/var/run/           runtime data: PID files, Unix domain sockets
+```
+`/var/log` fills up silently and is a common cause of full-disk failures on production systems. **logrotate** manages this: it compresses and archives old log files on a schedule, keeping the total log size bounded. The configuration in `/etc/logrotate.d/` specifies rotation frequency, retention count, and post-rotation actions (such as sending `SIGHUP` to reload a daemon's log file descriptor).
+`/var/run` is typically a tmpfs, cleared on every boot. Daemons write their PID files here so init systems and monitoring tools can check whether a service is running without executing it.