The /var filesystem

A cache for man pages that are formatted on demand. The source for manual pages is usually stored in /usr/man/man*; some manual pages might come with a pre-formatted version, which is stored in /usr/man/cat*. Other manual pages need to be formatted when they are first viewed; the formatted version is then stored in /var/man so that the next person to view the same page won't have to wait for it to be formatted. (/var/catman is often cleaned in the same way temporary directories are cleaned.)

Files that change while the system is running normally.

Variable data for programs that are installed in /usr/local (i.e., programs that have been installed by the system administrator). Note that even locally installed programs should use the other /var directories if they are appropriate, e.g., /var/lock.

Lock files. Many programs follow a convention to create a lock file in /var/lock to indicate that they are using a particular device or file. Other programs will notice the lock file and won't attempt to use the device or file.

Log files from various programs, especially login (/var/log/wtmp, which logs all logins and logouts into the system) and syslog (/var/log/messages, where all kernel and system program message are usually stored). Files in /var/log can often grow indefinitely, and may require cleaning at regular intervals.

Files that contain information about the system that is valid until the system is next booted. For example, /var/run/utmp contains information about people currently logged in.

Directories for mail, news, printer queues, and other queued work. Each different spool has its own subdirectory below /var/spool, e.g., the mailboxes of the users are in /var/spool/mail.

Temporary files that are large or that need to exist for a longer time than what is allowed for /tmp. (Although the system administrator might not allow very old files in /var/tmp either.)