3.2.6. The most common variable files
In the /var directory we find a set of
directories for storing specific non-constant data (as opposed to
the ls program or the system configuration files, which change
relatively infrequently or never at all). All files that change
frequently, such as log files, mailboxes, lock files, spoolers etc.
are kept in a subdirectory of /var.
As a security measure these files are usually kept in separate
parts from the main system files, so we can keep a close eye on
them and set stricter permissions where necessary. A lot of these
files also need more permissions than usual, like /var/tmp, which needs to be writable for everyone.
A lot of user activity might be expected here, which might even be
generated by anonymous Internet users connected to your system.
This is one reason why the /var
directory, including all its subdirectories, is usually on a
separate partition. This way, there is for instance no risk that a
mail bomb, for instance, fills up the rest of the file system,
containing more important data such as your programs and
||/var/tmp and /tmp
Files in /tmp can be deleted without
notice, by regular system tasks or because of a system reboot. On
some (customized) systems, also /var/tmp
might behave unpredictably. Nevertheless, since this is not the
case by default, we advise to use the /var/tmp directory for saving temporary files. When
in doubt, check with your system administrator. If you manage your
own system, you can be reasonably sure that this is a safe place if
you did not consciously change settings on /var/tmp (as root, a normal user can not do
Whatever you do, try to stick to the privileges granted to a
normal user - don't go saving files directly under the root (/) of
the file system, don't put them in /usr
or some subdirectory or in another reserved place. This pretty much
limits your access to safe file systems.
One of the main security systems on a UNIX system, which is
naturally implemented on every Linux machine as well, is the
log-keeping facility, which logs all user actions, processes,
system events etc. The configuration file of the so-called
syslogdaemon determines which and how long logged
information will be kept. The default location of all logs is
/var/log, containing different files for
access log, server logs, system messages etc.
In /var we typically find server data,
which is kept here to separate it from critical data such as the
server program itself and its configuration files. A typical
example on Linux systems is /var/www,
which contains the actual HTML pages, scripts and images that a web
server offers. The FTP-tree of an FTP server (data that can be
downloaded by a remote client) is also best kept in one of
/var's subdirectories. Because this data
is publicly accessible and often changeable by anonymous users, it
is safer to keep it here, away from partitions or directories with
On most workstation installations, /var/spool will at least contain an at and a cron directory,
containing scheduled tasks. In office environments this directory
usually contains lpd as well, which holds
the print queue(s) and further printer configuration files, as well
as the printer log files.
On server systems we will generally find /var/spool/mail, containing incoming mails for
local users, sorted in one file per user, the user's "inbox". A related directory is mqueue, the spooler area for unsent mail messages.
These parts of the system can be very busy on mail servers with a
lot of users. News servers also use the /var/spool area because of the enormous amounts of
messages they have to process.
The /var/lib/rpm directory is specific
to RPM-based (RedHat Package Manager) distributions; it is where
RPM package information is stored. Other package managers generally
also store their data somewhere in /var.