I got a disk-space alert on a small server and assumed it was a runaway log or a forgotten tarball. It was neither. journalctl --disk-usage cheerfully reported the journal was sitting at 3.8 GB on a 16 GB root partition, having grown there over a year of doing exactly what it was told.
That's the thing about persistent journals. The default is to use up to 10% of the filesystem, which sounds modest until your root partition is small and 10% is a lot. On a big box you never notice. On a homelab VM with a tight disk, it's a slow leak that eventually trips an alert at an inconvenient hour.
The fix is one config change. In /etc/systemd/journald.conf:
[Journal]
SystemMaxUse=500M
SystemKeepFree=1G
MaxRetentionSec=1month
Then systemctl restart systemd-journald to apply it. If you want the space back immediately rather than waiting for rotation, vacuum it by hand:
journalctl --vacuum-size=500M
That dropped me from 3.8 GB to half a gig in a few seconds, and the cap means it'll stay there. I set the same thing in my base config now so every new box gets it from day one. It's a five-minute job that I keep relearning because I only think about logging when it's already a problem. Half a gig of recent logs is plenty for the kind of debugging I actually do; a year of forgotten journal is just disk I'm paying for nothing.