обзор иерархии файловой системы  (File system hierarchy overview)
  
PERSISTENT VARIABLE SYSTEM DATA
/var/
           Persistent, variable system data. Must be writable. This
           directory might be pre-populated with vendor-supplied data,
           but applications should be able to reconstruct necessary
           files and directories in this subhierarchy should they be
           missing, as the system might start up without this directory
           being populated. Persistency is recommended, but optional, to
           support ephemeral systems. This directory might become
           available or writable only very late during boot. Components
           that are required to operate during early boot hence shall
           not unconditionally rely on this directory.
       /var/cache/
           Persistent system cache data. System components may place
           non-essential data in this directory. Flushing this directory
           should have no effect on operation of programs, except for
           increased runtimes necessary to rebuild these caches.
       /var/lib/
           Persistent system data. System components may place private
           data in this directory.
       /var/log/
           Persistent system logs. System components may place private
           logs in this directory, though it is recommended to do most
           logging via the syslog(3) and sd_journal_print(3) calls.
       /var/spool/
           Persistent system spool data, such as printer or mail queues.
       /var/tmp/
           The place for larger and persistent temporary files. In
           contrast to /tmp/, this directory is usually mounted from a
           persistent physical file system and can thus accept larger
           files. (Use /tmp/ for small ephemeral files.) This directory
           is generally not flushed at boot-up, but time-based cleanup
           of files that have not been accessed for a certain time is
           applied.
           If applications find the environment variable $TMPDIR set,
           they should use the directory specified in it instead of
           /var/tmp/ (see environ(7) for details).
           The same security restrictions as with /tmp/ apply:
           mkstemp(3), mkdtemp(3), and similar calls should be used. For
           further details about this directory, see Using /tmp/ and
           /var/tmp/ Safely[5].