A low-disk alert on a box that should have had plenty of room, and du pointed straight at /var/log/journal. Four gigabytes of journal on a machine that does almost nothing. Persistent journald with no cap will happily grow until it hits its default ceiling of 10% of the filesystem, which on a small root partition is a surprise you get to find out about at an inconvenient moment.
The fix is one config setting. In /etc/systemd/journald.conf:
[Journal]
SystemMaxUse=500M
SystemKeepFree=1G
MaxRetentionSec=2week
Then systemctl restart systemd-journald. To reclaim space immediately rather than waiting for rotation:
journalctl --vacuum-size=500M
SystemMaxUse caps the total, SystemKeepFree makes journald back off if the disk gets tight regardless, and MaxRetentionSec drops anything older than a fortnight. That's the lot. Logs are useful, but not three weeks of debug chatter on a box you check once a quarter. Set the cap when you build the machine, not when the disk alert fires.