For all appliances, /var must be large enough to host logs files and at least one core, one javacore, and one heapdump file at a minimum.
For Filrsearch, /var should be 3 times total RAM.