Please, only people that have used the "uutils coreutils" version of the du command should comment.
Compare the following outputs of the commands ran on an Ubuntu 25.10 system:
# du -smc /var
8670 /var
8670 total
# du -smc /var/log
1548 /var/log
1548 total
# du -smc /var/log /var
1548 /var/log
8670 /var
10217 total
# du --version
du (uutils coreutils) 0.2.2
vs:
# /snap/core22/2134/usr/bin/du -smc /var
8670 /var
8670 total
# /snap/core22/2134/usr/bin/du -smc /var/log
1548 /var/log
1548 total
# /snap/core22/2134/usr/bin/du -smc /var/log /var
1548 /var/log
7122 /var
8670 total
# /snap/core22/2134/usr/bin/du --version
du (GNU coreutils) 8.32
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Written by Torbjorn Granlund, David MacKenzie, Paul Eggert,
and Jim Meyering.
Is this a bug in the "new" Rust-based utilities?
# type du
du is hashed (/usr/bin/du)
# ls -l /usr/bin/du
lrwxrwxrwx 1 root root 29 Sep 26 21:16 /usr/bin/du -> ../lib/cargo/bin/coreutils/du
If this is not a bug, how can I get the size of /var/log, the size of the rest of /var (excluding /var/log), and the correct summary of the whole size of /var as given by the GNU version of du?
This has nothing to do with the "varying contents" of the /var directory. As another example see this:
$ du -smc /usr
8010 /usr
8010 total
$ du -smc /usr/bin
636 /usr/bin
636 total
$ du -smc /usr/bin /usr
636 /usr/bin
8010 /usr
8646 total
$ du -smc /usr /usr/bin
8010 /usr
636 /usr/bin
8646 total
vs:
$ /snap/core22/2134/usr/bin/du -smc /usr
8010 /usr
8010 total
$ /snap/core22/2134/usr/bin/du -smc /usr/bin
636 /usr/bin
636 total
$ /snap/core22/2134/usr/bin/du -smc /usr/bin /usr
636 /usr/bin
7374 /usr
8010 total
$ /snap/core22/2134/usr/bin/du -smc /usr /usr/bin
8010 /usr
8010 total