...minute learning has occurred, and now I have a headache.
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
H...how are these defaults anything but an invitation to overfill the disk, even if uncommented? Surely I'm missing something...
Edit: Yes, I was. The logs are supposed to cap at ~20% of your filesystem (10% each for system and runtime, which are archived and active logs respectively), and leave a minimum of 15% free. If the file system dips under 15% though, from what I understand in the manpages, in low space scenarios it may exceed that, and it only deletes archived logs, so if a new log is created that fills the filesystem...
If I understand correctly, editing /etc/systemd/journald.conf so SystemMaxFileSize and RealtimeMaxFileSize are fairly small (and removing the # so the line isn't commented out), logs should never get over 1 GB for both active and archived. Alternatively, MaxRetentionSec can be set to an amount of time to have logs deleted once they're older than that, though they'd have to rotate out before that can happen. Alternatively, a sufficiently large SystemKeepFree and RuntimeKeepFreeought to stop the logs from growing if you have less free space than you set.
If my babbling is accurate, I'll write up a proper how to sometime this week.