# Demonstration: Two Different Questions, Two Different Commands

## OBSERVE

```
$ df -h /
Filesystem  Size  Used  Avail  Use%  Mounted on
overlay     937G  199G   691G   23%  /
```

The root filesystem overall: 23% used, plenty free.

## HYPOTHESIS

Predict: does this tell you anything about which specific directory is using the most space?

## INSPECT

```
$ du -sh /var/log/* 2>/dev/null
1.2M  /var/log/nginx
850K  /var/log/k3s.log
```

No — `df` only ever answers "how full is this filesystem overall." Finding a SPECIFIC large
consumer requires `du`, pointed at the directories you suspect.

## CHANGE

Narrow further into a single suspicious directory:

```
$ du -sh /var/log/nginx/*
600K  /var/log/nginx/access.log
600K  /var/log/nginx/error.log
```

## VERIFY

You now know both the overall filesystem picture (`df`) AND exactly which files are contributing
to it (`du`, narrowed progressively) — two genuinely different tools for two genuinely different
questions, not interchangeable.

## Instructor Notes

**Demo goal:** Make the df/du distinction concrete by actually needing BOTH to answer a
realistic "what's using my disk" question.

**Approximate timing:** 8 minutes live.

**Common mistake to watch for:** running `du -sh /` directly (extremely slow on a large
filesystem, since it recurses everything) instead of narrowing progressively into suspected
directories first.