Why do df and du disagree?

The quick answer

df reports allocated filesystem blocks; du totals reachable directory entries. Deleted files still held open by a process can explain a discrepancy.

df -h; du -sh /var

What's going on?

df reports allocated filesystem blocks; du totals reachable directory entries. Deleted files still held open by a process can explain a discrepancy.

Understanding the underlying mechanism makes troubleshooting much easier than memorising a command in isolation.

Dig a little deeper

Use sudo lsof +L1 to find deleted but open files. Check filesystem reserved blocks with tune2fs -l (ext filesystems), and make sure du isn't traversing another mounted filesystem.

Hands-on commands

Try these in a suitable test environment. Read each command before running it, especially if you have elevated privileges.

df -h /var
sudo du -xsh /var
sudo lsof +L1