/var is the standard Unix and Linux filesystem location for variable data such as logs, caches, and runtime files. Understanding its layout helps system administrators and developers manage storage, permissions, and service behavior more reliably.
On modern distributions, /var is often a separate partition, which isolates growing files from the root filesystem and protects system stability. The following overview explains its structure and purpose for both newcomers and experienced operators.
| Path | Typical Purpose | Contents Type | Growth Characteristics |
|---|---|---|---|
| /var/log | Service and system logs | Text and binary logs | High growth, long-term retention |
| /var/cache | Application caches | Persistent cache data | Moderate growth, can be cleaned |
| /var/spool | Queued work items | Mail, print jobs, updates | Bursty, depends on workload |
| /var/lib | State and database files | Structured data and configs | Steady growth, critical for operations |
| /var/tmp | Temporary files across reboots | Large or persistent temp data | Unpredictable, managed by applications |
Directory Structure and Organization
/var follows the Filesystem Hierarchy Standard (FHS), which defines consistent locations for runtime and variable data. Each subdirectory has a clear role, making it easier to locate logs, caches, or application state.
Common subdirectories include /var/log for logs, /var/cache for reusable data, and /var/lib for persistent application state. This organization simplifies troubleshooting, backup planning, and storage management across servers and workstations.
Permissions and Security Considerations
Correct ownership and permissions in /var are essential for system integrity, because many services write to these directories. Misconfigured access can expose sensitive logs or allow attackers to disrupt services through cache or log injection.
Best practice is to assign each service its own dedicated user and group, with access limited to the specific subdirectories it requires. Regular audits and the use of tools like access control lists help maintain tight security without breaking functionality.
Log Management and Rotation
Log files under /var/log can grow quickly and consume disk space if left unchecked. Logrotate and similar utilities automate compression, archiving, and deletion to keep logs useful without overwhelming storage.
Configure rotation policies based on size and time, with monitoring in place to detect issues before they escalate. Centralized logging or remote log shipping further protects important events in case of local disk failure.
System Stability and Backup Strategies
Because /var contains runtime data that changes frequently, it benefits from dedicated partitions and regular backups. Separating it from / reduces the risk of a full root filesystem due to excessive logs or cache growth.
Backups should emphasize /var/lib and /var/log, since losing database or audit data can impact operations and compliance. Snapshot and incremental strategies help recover quickly without extended downtime.
Operational Best Practices and Maintenance
Maintaining /var effectively reduces outages, simplifies audits, and supports compliance. A few disciplined habits go a long way toward keeping variable data reliable and efficient.
- Monitor partition usage and set alerts before reaching capacity limits.
- Automate log rotation and retention policies for /var/log.
- Separate volatile data by placing /var on its own partition or volume.
- Regularly back up critical state under /var/lib and configuration in /var/log.
- Review permissions and service ownership to follow the principle of least privilege.
FAQ
Reader questions
Why is my server running out of space even though /usr and /home have plenty of free space?
The root cause is usually unbounded growth in /var/log or /var/cache. Large application logs or stale cache files can fill a dedicated partition quickly, so inspecting these directories and enabling log rotation typically resolves the issue.
How do I inspect which subdirectories under /var are using the most disk space?
Use commands like du with human-readable output to size each major subdirectory under /var. Sorting the results highlights the heaviest consumers so you can target cleanup or archiving where it is most needed.
Can /var be resized on a live system, and what should I watch out for?
Resizing is possible with logical volume management or cloud block storage, but it requires unmounting or pausing dependent services. Plan maintenance windows, back up critical data in /var/lib and /var/log, and verify filesystem integrity after resizing to prevent corruption.
What are the risks of mounting /var as noexec or read-only in production?
Noexec can break legitimate service writes to temporary directories, while read-only mounts may stop daemons that need to update state files. Test such restrictions in staging and apply them only where applications explicitly support them, monitoring for denied write errors.