I run a script on my Linux machines that every night checks if anything has changed in /etc and below and if it has, makes a backup, keeping the last 5 versions.
This way I can check when something stops working if any configuration has changed.

Now I noticed that on one server (running Slackware 12.2 stable) my script said that the configuration changed every day.
Digging in a bit deeper, I found that ntp that runs on that particular box keeps the drift file in /etc/ntp and that file changes daily.

I found some discussions on the internet that this file should be in /var/lib/ntp - which makes sense to me, as it is not a configuration file at all.

I made the change myself (in /etc/ntp.conf) and now my script stops warning me about the new configuration every day.

The official ntp site says the default is /etc/ntp.drift and does not elaborate much on the subject.

The FHS tells us about /etc:
The drift file is definitely not "static".

It tell us about /var:
I vote for changing the ntp drift file to /var/lib/ntp in Slackware.
Should this be changed in the next release of Slackware by including a patched /etc/ntp.conf file?
After all, Slackware seems to follow the FHS quite well.

Hi neils. When I first looked at you post I had to agree as the reasoning behind files in /etc being static makes sense. However that prompted me to have another look at the dates and timestamps of files in there.

Notice there is also the files under /dhcpc and /etc/ld.so.cache which are transient. There are probably others that I haven't noticed yet.

So it would seem some applications do store non-static data in there. Perhaps we are misreading the FHS's meaning on this or perhaps it's just being ignored ?

Indeed, there might be others... This is one I noticed
Well, I'd like to hear opinions: should we follow the FHS standard in these cases or not?

I'm pretty sure that /etc/ld.so.cache is one of those historical exceptions like /etc/mtab is not static. I don't use dhcpc so I'm not sure what files it maintains under /etc.

I also don't use ntp, but from this description:

The drift file is used to record the frequency offset of the local clock oscillator. If the file exists, it is read at startup in order to set the initial frequency offset and then updated once per hour with the current frequency offset computed by the daemon. If the file does not exist or this command is not given, the initial frequency offset is assumed zero. In this case, it may take some hours for the frequency to stabilize and the residual timing errors to subside.

it looks like it gets updated quite a lot. My feeling is that it would be more correctly placed under /var. But I'm not convinced that /var/lib/ntp would be right -it might be more correct under /var/run. But, /var/lib/??? serves as a catchall for other transient, hard-to-define files, so it is probably legal...

From the ntp documentation.
So, the ntp.drift file is updated hourly, but over time the data stored within it will become static. It is a file that can fit with either definition.
My opinion is that the decision lies with the upstream developers, who have decided to make /etc/ntp.drift the default. You are free to make a change if you desire.
One of the features of Slackware is that it respects the decisions of the upstream developers. This is usually a good thing, but it is easy to find situations in Slackware where a change in the default configuration can lead to enhanced usability. My pet example here is with xpdf. The default xpdf.rc has entries to point to Windows font files, but these need to changed to point to the default location of these font files in Slackware. This makes xpdf usable for pdf documents developed using Windows fonts. (I know there are better pdf viewers, but xpdf loads up very quickly and I make a lot of use of it for this reason).
I would prefer that Slackware continue with respecting the decisions of the upstream developers.

I picked /var/lib/ntp as it seems to be a common solution used in other distros.
I did some googling and found several references to this location.
At least it seems more appropriate than anything under /etc.

I also do not use dhcpc so I have had no conflicts with that one.

/etc/mtab is another situation, as it is "quite static" on most servers.
On desktops it might change a lot though.
I *think* the same goes for /etc/ld.so.cache

I found some references like this:
ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
/var/log/ntpstats
/etc/ntpd.conf
/etc/ntp/step-tickers

but also this:

driftfile /var/lib/ntp/drift

This is how I did it, putting this line in /etc/ntp.conf

I never really cared for the idea of /var/lib/... as unlike /lib, or /usr/lib it doesn't contain libraries so the name just doesn't seem right to me. /var/state as a name seemed far more logical to me, but it looks like the FHS has chosen to go with /var/lib instead. Anyway, despite my nitpicking on the name, I agree with the guys above that the file really doesn't belong in /etc. /var/run doesn't seem to be the right place either, so /var/lib/ntp/ seems like a good choice.

Don't worry about the nitpicking. I created this whole thread because I am a nitpicker

I do believe in following standards, as it makes administration of several machines so much simpler...

No argument from me there, I just wish that the 'standards' were a little more logical in places.

Yeah I know... And I'll never forget a phrase told to me many, many, years ago:

Its pretty standard for myself and many others to have /var on it's own partition (and possibly even a network share (unlikely as it may be)) the partition needs to be available when the startup services are run.

I remember dhcpc having issues when someone tried to force a change from /etc to /var for the state files. You want your networking up before trying to mount remote shares after all.

/etc should be on the root partition and is one reason why some of these files reside there. Others (as mentioned) are either just historical or are just the way that upstream do things...

Never take anything at face value as there are often some obscure reasons for things being the way they are.

On most professional *nix servers, /var is on its own partition indeed.
Sub-dirs might be on external network shares or storages, but usually not the standard sub-folders like /var/run, /var/lib etc. At least, in my experience.

I respect (most) upstream developers, but my idea of open software is that I am in control.
So if I think that non-static files don't belong in /etc, I'll move them to a better place.

One thing I learned after several decades of working in the IT / support business is not to accept simply what suppliers / upstream developers tell me to do. I question things a lot. And I don't accept answers like "we do it this way because we always did it this way". I am always open for good arguments though.

@mRgOBLIN: Thanks for the information I was wondering about that !