A box paged me for low disk on root, and the culprit was the one I always forget: the journal. By default systemd-journald is allowed to use up to 10% of the filesystem it lives on, and on a small root partition that 10% arrives faster than you would like, especially on a chatty machine that has been up for a year.
First, see the damage:
journalctl --disk-usage
Mine was sitting at 3.8G. You can free it immediately by size or by age:
journalctl --vacuum-size=500M
journalctl --vacuum-time=14d
That reclaims the space now, but it will fill straight back up unless you cap it. The durable fix is in /etc/systemd/journald.conf:
[Journal]
SystemMaxUse=500M
SystemMaxFileSize=50M
Then systemctl restart systemd-journald and it enforces the cap from then on. SystemMaxUse is the total it will keep; SystemMaxFileSize just keeps individual files small enough to rotate sensibly.
That is the whole job. The only thing worth adding is a question: do you actually want a year of logs on this host, or is it shipping them somewhere central anyway? If they are going to a log aggregator, the local journal only needs to hold enough to debug the last incident, and 500M is generous for that. Set the cap, move on, and stop letting the default 10% decide how much of your disk the logs are entitled to.