The reason why there isn't a universal guide for cleaning /var is that it highly depends on the system. In short, /var is probably the most distribution-specific part of the filesystem hierarchy. Apart from logs, typically managed by logrotate (see ddeimeke's answer), the following factors can significantly differ from installation to installation:
- the way your distribution handles package installation: how much management-related and build-time data does it store, and under what specific paths,
- the history of package installation, including installation attempts that failed for whatever reason,
- automatic clean-ups scheduled by default by your distro,
- the structure of
/var: is it standardised by the distro (paths adjusted in the packaging process for each distributed package) or left the way each program has defined for itself,
- the specific software installed and used: each has its own settings that determine how much is stored, where, and quite often also for how long.
So, if you are looking for a generic way for doing clean-up, a there are generally two ways to go: search for distribution-specific information about managing /var or(and) manually determine, what part of the /var subtree is filled most often.
For the latter, you can use many tools, but probably the most generic is the du (DiskUsage) command-line program, together with xdiskusage for visualisation. If it's a headless server, you can store the output from du to a file, download it and run xdiskusage locally, supplying du's output file as a parameter. The next step to implement some regular clean-up routines is determining, which program is responsible for which file(s) - some of this you can easily deduce, but in some cases you will have to use your distribution's package management utilities - they can very often tell you, which package a specific path belongs to.
