Differences

This shows you the differences between two versions of the page.

--- path-var [May 14, 2026 at 11:38] – external edit 127.0.0.1
+++ path-var [June 13, 2026 at 03:13] (current) – created - external edit 127.0.0.1
@@ Line 1: / Line 1: @@
 # /var
+**/var** holds variable data: files whose content grows and changes during normal system operation. Log files, mail spools, package manager caches, lock files, and runtime state all live here. Separating this from `/usr` (which is largely static after install) makes it practical to mount `/usr` read-only and to size partitions appropriately — `/var` needs room to grow, `/usr` does not.
+```
+/var/log/           log files written by the kernel and system services
+/var/log/syslog     general system log (Debian/Ubuntu)
+/var/log/auth.log   authentication events: logins, sudo, SSH
+/var/log/nginx/     web server access and error logs
+/var/cache/         cached data that can be regenerated if deleted
+/var/cache/apt/     downloaded .deb packages (safe to clear with apt clean)
+/var/lib/           persistent state for applications and services
+/var/lib/dpkg/      dpkg's database of installed packages
+/var/lib/postgresql/ PostgreSQL data files
+/var/spool/         queued work awaiting processing
+/var/spool/cron/    per-user crontabs
+/var/spool/mail/    incoming mail before delivery to user mailboxes
+/var/tmp/           temporary files that persist across reboots (unlike /tmp)
+/var/run/           runtime data: PID files, Unix domain sockets
+```
+`/var/log` fills up silently and is a common cause of full-disk failures on production systems. **logrotate** manages this: it compresses and archives old log files on a schedule, keeping the total log size bounded. The configuration in `/etc/logrotate.d/` specifies rotation frequency, retention count, and post-rotation actions (such as sending `SIGHUP` to reload a daemon's log file descriptor).
+`/var/run` is typically a tmpfs, cleared on every boot. Daemons write their PID files here so init systems and monitoring tools can check whether a service is running without executing it.
- - [[path-var-cache|/var/cache]]
- - [[path-var-db|/var/db]]
- - [[path-var-empty|/var/empty]]
- - [[path-var-lib|/var/lib]]
- - [[path-var-local|/var/local]]
- - [[path-var-lock|/var/lock]]
- - [[path-var-log|/var/log]]
- - [[path-var-opt|/var/opt]]
- - [[path-var-run|/var/run]]
- - [[path-var-www|/var/www]]
- - [[path-var-spool|/var/spool]]
- - [[path-var-tmp|/var/tmp]]