So should I just resize /var? Is that the best solution? I know I did cp with the --sparse=always option.
I'm a little confused by your answer, I've read up on sparse and maybe I'm interpreting it wrong, by using the sparse option, wouldn't this stop it from actually filling up the physical disk? Perhaps I'm just missing something, how large does /var need to be? Even after an initial whonix install I have 8gb+ left in root but then it fills up.