What is stored in /var, and why does it keep growing?
/var holds variable data that changes while the system runs: logs, mail spools, package caches, databases and print queues. It grows because logs and caches accumulate, which is why a full /var is a common cause of a server misbehaving.
Explain it simply
If /etc is the notice board, /var is the dustbin and the register book: things pile up as the day goes on. Programs write to it constantly.
Common contents: /var/log (log files), /var/cache (downloaded packages and caches), /var/lib (state such as MySQL or PostgreSQL data and Docker images), /var/spool (queued mail and print jobs) and /var/tmp (temporary files that survive reboot).
Since these files only grow, an unchecked log can fill the disk. Then databases stop writing and services crash. That is why many servers keep /var on its own partition: a runaway log can then fill only /var, not the whole system. Log rotation (logrotate) and journal size limits keep it under control.
Example
sudo du -h --max-depth=1 /var | sort -h | tail -3
# 1.2G /var/cache
# 3.4G /var/log
# 9.8G /varWhat to say in the interview
"/var is for data that changes at runtime: logs, caches, spools and application state like database files. It grows steadily, so when a server runs out of space I check du on /var/log first and rely on logrotate and journald limits to prevent it."
Common mistakes
- Deleting files in /var/lib by hand; that is live application data.