journald filling /var/log

/var/log/journal grew to several gigabytes; journalctl --disk-usage showed it was all history.

Trim it now:

journalctl --vacuum-size=200M

And permanently in /etc/systemd/journald.conf:

SystemMaxUse=200M
SystemMaxFileSize=50M

Note that Storage=persistent is what writes to /var/log/journal; volatile keeps logs in memory and loses them on reboot. In containers without that directory, logs live under /run/log/journal and vanish with the container.

journalctl -u app --since '1 hour ago' is also far faster than grepping a file, which matters once logs are large.