# Guided Exercise: Plan Your Inspection Before You Type Anything

This is a paper exercise — commit to a plan before running commands in the Lab.

## Your task

You're told "the payments service seems slow." Before touching a keyboard, write down, in
order, which of these five questions you'd check FIRST, SECOND, and so on, and the one command
you'd use for each:

- Is it running at all?
- Is it listening on its expected port?
- What does its configuration say?
- What do its recent logs say?
- Has anything changed recently?

## A worked shape to check yourself against

A reasonable order: (1) is it running — `pgrep`/`ps`; (2) is it listening — `ss -lnt`; (3) recent
logs — `tail -n 50 <logfile>` (recent activity is usually more informative than config for a
sudden "slow" complaint); (4) configuration — only if logs point at a config-driven cause; (5)
recent changes — depends on context (deployment history, `ls -la` timestamps on config files).
There's no single correct order, but "running, then listening, then logs" before jumping to
config is a defensible default — you're checking the cheapest, fastest-answering questions
first.

## Instructor Notes

**Facilitation:** There's genuine room for disagreement on ordering here — the value is in
students defending their reasoning, not converging on one "correct" sequence.

**Approximate timing:** 8-10 minutes live discussion; 5 minutes self-paced.