# Reflection: "It's Probably the Logs" Is a Guess, Not a Diagnosis

## Reflection questions

1. Before measuring, which of the three directories in this module's Lab did you guess would
   be largest? Were you right?
2. Why does "persistent vs. temporary" matter enough to be worth memorizing as a question you
   ask about EVERY piece of data, not just during a storage module?

## Real Ops takeaway

**Guessing which directory is consuming disk space, without measuring, is exactly the kind of
assumption that wastes real incident-response time.** `du`, applied progressively (broad, then
narrow), replaces guessing with evidence in seconds. And the persistent-vs-temporary question
you just practiced is the exact same question you'll ask again in ROOT 04 about container data,
and again much later about Kubernetes storage — a question worth internalizing now, cheaply,
rather than learning the hard way after data you assumed would persist didn't.

This module is complete. Continue to the next module.

## Instructor Notes

**Discussion questions for a live classroom:** question 1 works well as a quick poll before
revealing the real answer — the mismatch between guesses and reality reinforces the lesson
better than stating it directly.

**Approximate timing:** 5-8 minutes live discussion; 5 minutes self-paced writing.