On my OT-2, I have a 50 MB /data/nginx-access.log that appears to be actively updated. It looks like nginx is logging things there instead of to journald.
It should probably go to journald because that's where other services on our system generally log to.