# Demonstration: Answering the Five Questions For Real

## OBSERVE

This Lab's own terminal is served by a real running service: nginx.

```
$ pgrep -x nginx
906
```

Something with PID 906 is running.

## HYPOTHESIS

Predict: where would nginx's configuration file be, and where would its logs be?

## INSPECT

```
$ cat /etc/nginx/nginx.conf | head -5
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;
...
$ ls /var/log/nginx/
access.log  error.log
```

## CHANGE

Confirm it's actually listening on the port you'd expect:

```
$ ss -lnt | grep :80
LISTEN 0  511  0.0.0.0:80  0.0.0.0:*
```

## VERIFY

All five questions answered with real evidence, not assumptions: it's running (PID 906),
listening on port 80, configured at `/etc/nginx/nginx.conf`, logging to `/var/log/nginx/`. This
exact sequence — process, port, config, logs — is what you'll repeat for almost any unfamiliar
service on any real system.

## Instructor Notes

**Demo goal:** Show the five-question checklist answered end-to-end against a real, already-
running service the students are themselves using right now — more convincing than an
abstract example.

**Approximate timing:** 8 minutes live.

**Common mistake to watch for:** stopping here at "PID exists" without also confirming it's
actually listening on the expected port — a process existing and a service actually being
reachable are two different facts, both worth checking.