# Guided Exercise: Narrow Down a Disk Problem on Paper

This is a paper exercise — commit to a plan before running commands in the Lab.

## Your task

`df -h /` shows the root filesystem is 95% full. You have three suspect directories:
`/var/log`, `/srv/cache`, and `/home`. Write the exact sequence of `du` commands you'd run to
find the actual culprit, narrowing your search efficiently rather than checking everything with
maximum depth immediately.

## A worked shape to check yourself against

```
du -sh /var/log /srv/cache /home
```

— one command, comparing all three top-level suspects at once. Whichever is largest, THEN
narrow further into it specifically (e.g. `du -sh /srv/cache/*` if that one's the culprit) rather
than deep-diving into all three from the start — this mirrors Module 1's "cheapest, fastest-
answering question first" principle.

## Instructor Notes

**Facilitation:** Point out that running `du -sh` separately three times versus once with all
three paths produces the same information — the point isn't syntax, it's the "compare broadly,
then narrow" strategy.

**Approximate timing:** 8-10 minutes live discussion; 5 minutes self-paced.