A small VPS started warning on disk, and the culprit was the systemd journal sitting at four gigabytes. On a box with a 20GB root that is rude. The journal defaults to capping itself at 10% of the filesystem, which sounds reasonable until your filesystem is small and your services are chatty.
First, see what it is actually using:
journalctl --disk-usage
You can prune by size or by age, and both are useful. To trim immediately:
journalctl --vacuum-size=200M
journalctl --vacuum-time=2weeks
To make it stick, set a hard ceiling in /etc/systemd/journald.conf rather than relying on the percentage default:
[Journal]
SystemMaxUse=200M
Then systemctl restart systemd-journald and it behaves. Two hundred megabytes is plenty of history for a small box, and if I need more than two weeks of logs I should be shipping them off the machine anyway. That is the real fix here: the journal is for the recent past, not an archive. Cap it, forget about it, and send anything you care about somewhere with proper retention.