If one runs htop as root with: sudo htop --sort-key PERCENT_MEM -d 1 one can easily try to trigger strace on the (system) process which gets called which eats up memory by hitting "s". I have tried that but come up empty. Similarly running strace on systemd-journald doesn't tell at least me anything quite revealing or stupid it may be doing.