`/var`

Overview

/var holds variable data — files that grow and change as the system runs, most importantly logs. For security work, /var/log is one of the most valuable directories on the entire system. This lesson explains /var and why it matters.

Learning objectives

• Describe the purpose of /var and its subdirectories.
• Identify /var/log as the central location for logs.
• Explain the security importance of logs.

Core concept

/var stores data that changes frequently during normal operation, separated from static program files. Key subdirectories include:

• /var/log — system and service log files (authentication, kernel, service activity).
• /var/spool — queued data (e.g. print jobs, mail).
• /var/cache — cached data for applications.
• /var/tmp — temporary files that persist longer than /tmp.

Of these, /var/log is the one security professionals rely on most.

How it works

As services run, they append records to log files under /var/log — for example, authentication attempts, errors, and service events. These logs accumulate over time (and are usually rotated to manage size). Because they record what happened and when, they are the primary source of truth for troubleshooting and for investigating suspicious activity. Reading a log is often as simple as viewing the text file, though many modern systems also use a journal (covered in the logs module).

Practical example

Common log files include /var/log/auth.log (or /var/log/secure on Red Hat systems) for authentication events and /var/log/syslog//var/log/messages for general system messages. Reviewing failed login attempts, for instance, means examining the authentication log to see repeated failures from an address — a possible sign of a brute-force attempt.

Cybersecurity relevance

Logs in /var/log are central to detection, incident response, and forensics: they reveal login attempts, privilege escalations, errors, and service behavior. Defenders monitor them for signs of attack; investigators reconstruct events from them. Attackers, in turn, may try to tamper with or delete logs to hide their tracks, which is why log integrity and centralized/off-host logging matter. Knowing where logs live is the starting point for all of this.

Common mistakes

• Not knowing logs live in /var/log, slowing investigation.
• Ignoring log rotation, then being confused when older entries are compressed or moved.
• Assuming logs are tamper-proof — attackers may alter them, so integrity controls matter.

Key takeaways

• /var holds variable, changing data; its most security-relevant subdirectory is /var/log.
• /var/log contains authentication, system, and service logs — the primary record of what happened on a system.
• Logs are essential for detection and forensics, are a target for attacker tampering, and knowing their location is fundamental to Linux security.

Check your understanding

• Which subdirectory of /var is most important for security, and what does it contain?
• Why might an attacker target log files, and what does that imply for defenders?