The journal eats gigabytes before anyone notices

With no configuration, systemd-journald will use up to 10 % of the partition holding /var/log/journal (at most 4 GiB), while keeping at least 15 % free. On a machine with a 20 GB root that is two gigabytes of logs nobody will ever read.

How much it uses right now:

journalctl --disk-usage

A one-off cleanup, either by size or by age:

journalctl --vacuum-size=200M
journalctl --vacuum-time=14d

The permanent setting belongs in /etc/systemd/journald.conf, because a one-off vacuum configures nothing:

[Journal]
SystemMaxUse=200M
MaxRetentionSec=14day

After the change, systemctl restart systemd-journald is enough.

Two things to watch. Vacuum removes whole journal files rather than individual entries, so the real boundary sits slightly above the value you ask for. And if /var/log/journal does not exist, the journal runs in memory only (/run/log/journal) and disappears on reboot – that is not a saving, that is losing the history.