Go hunt with the du
tool:
pi@noads:~ $ sudo du --max-depth=1 -h /var
35M /var/www
4.0K /var/tmp
4.0K /var/local
12K /var/mail
7.0M /var/log
651M /var/cache
1.9M /var/backups
144M /var/lib
36K /var/spool
4.0K /var/opt
938M /var