I notice your terminal output shows only (presumably) the size of the /var folder, not its contents.
ls would display directory size, df should add up directory contents, recursively. But it doesn't account for cluster size overhead. And I suspect that is where the space is going, in directories full of lots many thousands) of tiny files.
I work for the Department of Redundancy Department
