THE DISK SPACE DETECTIVE

A Film Noir Educational Mystery in Three Acts

[FADE IN: Black and white. Rain pattering on a terminal window. A saxophone plays in the background.]

ACT 1: THE CASE ARRIVES

DETECTIVE CLAUDE sits at a desk, feet up, hat tipped low. The green glow of a terminal reflects off their trench coat. A message pops up on screen.

DETECTIVE CLAUDE (narrating) "It was a cold November evening when the call came in. The kind of call that makes you reach for your commands before your coffee."

USER (voiceover) "Detective... how much disk space does this machine have?"

DETECTIVE (standing up, cracking knuckles) "Simple question. But in my line of work, simple questions lead to complicated answers. Time to take the vital signs."

[Detective pulls out a magnifying glass labeled df -h]

DETECTIVE (breaking 4th wall to audience) "First rule of disk investigation, students: Always start with df -h. The 'df' stands for 'disk free', and that '-h' flag? That's 'human-readable'. Because nobody wants to read bytes when they could read gigabytes. We're humans, not calculators."

[Types command. Output appears on a dusty chalkboard:]

Filesystem       Size  Used Avail Use% Mounted on
/dev/root         19G   17G  2.2G  89% /

DETECTIVE (removing sunglasses slowly) "Mother of malloc..."

[DRAMATIC ZOOM on the 89%]

DETECTIVE (narrating) "Nineteen gigs total. Seventeen used. Only 2.2 left. At 89% capacity, this machine was on life support. The disk was gasping for air like a CS student during finals week."

[Thunder crashes]

DETECTIVE (to audience) "The victim was barely alive. But who did this? Where did all the space go? Time to investigate. And in this business, you don't just run in guns blazing. You need a strategy."

ACT 2: THE INVESTIGATION

SCENE 1: "FOLLOW THE MONEY" - The Top-Level Sweep

[Detective stands before a map of the filesystem, with / at the center like a crime scene diagram]

DETECTIVE "I needed answers fast. But the filesystem? It's huge. Millions of files. Thousands of directories. I couldn't search them one at a time - I'd be here until the heat death of the universe."

[Snaps fingers. THREE CLONES of Detective Claude appear]

DETECTIVE (to audience) "Lesson two: When you've got independent leads, PARALLELIZE. Run multiple commands at once. Your terminal can handle it, and your investigation moves at lightspeed."

ORIGINAL DETECTIVE: "You - check /home!" CLONE 1: "On it!" (runs du -h --max-depth=1 /home)

ORIGINAL: "You - interrogate the root directory!" CLONE 2: "Roger!" (runs sudo du -h --max-depth=1 /)

ORIGINAL: "You - find me every node_modules directory. Those things are always suspicious." CLONE 3: "Already typing!" (runs find /home -type d -name "node_modules")

ORIGINAL: "And I'll check the temp files." (runs du -sh /tmp)

DETECTIVE (to audience) "We're using du - disk usage. Think of it like a metal detector, but for bytes. The --max-depth=1 flag? That means 'don't go too deep yet, just show me the top level'. You gotta search systematically."

[The four detectives work simultaneously. Results appear on different chalkboards]

CLONE 2 (shouting) "Boss! I found the big three!"

7.4G  /snap
6.9G  /home
4.2G  /var

DETECTIVE "Seven point four gigs in /snap? Six point nine in /home? Kid, we've got ourselves three heavyweight suspects."

CLONE 3 "Detective! I found node_modules! Multiple locations!"

DETECTIVE (pulls out a notepad) "Ah yes. Everyone's favorite scapegoat. Those bloated package directories that multiply like rabbits. Let's see how guilty they really are..."

[Dramatic pause]

SCENE 2: "DIG DEEPER" - Following the Leads

[Detective walks down a dark corridor labeled /home/ubuntu. Each door is a subdirectory.]

DETECTIVE "The initial sweep gave me suspects. Now I needed details. Time to knock on some doors."

[Runs du -h --max-depth=1 /home/ubuntu | sort -hr | head -20]

DETECTIVE (to audience) "Check out this command pipeline. du gives me the data. But raw data is chaos. So I pipe it to sort -hr - that's 'human-readable sort, reverse order'. Biggest fish first. Then head -20 shows me just the top 20. Twenty suspects, not two thousand."

[A sorted list appears, cinematic slow-motion]

5.9G  /home/ubuntu
2.5G  /home/ubuntu/.cache
1.8G  /home/ubuntu/.npm
1.1G  /home/ubuntu/workplace

DETECTIVE "Well, well, well. What do we have here? Two and a half gigs of CACHE? One point eight gigs of NPM cache?"

[Dramatic pointing at the chalkboard]

"And down here..."

58M   /home/ubuntu/yap/node_modules
639M  /home/ubuntu/workplace/AhaiaApp/music/web/node_modules

DETECTIVE (slowly turning to camera) "Node_modules. Total? About 697 megabytes."

[Audience gasps]

DETECTIVE "Ladies and gentlemen, students of computer science - this is what we call a RED HERRING. Everyone blames node_modules. 'Oh, node_modules is so huge!' But here? They're innocent. The REAL criminals? Cache directories."

DETECTIVE (to audience) "Lesson three: Don't assume. INVESTIGATE. Measure. Because assumptions make an ass out of u and umptions."

SCENE 3: "THE USUAL SUSPECTS" - The Cache Investigation

[Detective enters a dimly lit room. Three figures sit in chairs under a hanging light bulb.]

DETECTIVE "Let's meet the hoarders."

[Runs du -h --max-depth=1 /home/ubuntu/.cache | sort -hr]

[The three figures are revealed:]

PUPPETEER PETE - A nervous-looking program clutching browser icons PLAYWRIGHT PAULA - Similar to Pete, also holding browser icons HOMEBREW HARRY - An older gentleman surrounded by package boxes

1.2G  /home/ubuntu/.cache/puppeteer
901M  /home/ubuntu/.cache/ms-playwright
264M  /home/ubuntu/.cache/Homebrew

DETECTIVE "Puppeteer Pete. One point two gigabytes. What's your story?"

PUPPETEER PETE (nervously) "Look, Detective, I just... I need browsers! Chrome 114, Chrome 115, Chrome 116... What if someone needs an old version?"

DETECTIVE "You downloaded ENTIRE BROWSERS and kept them in cache?"

PLAYWRIGHT PAULA (defensive) "I did it too! 901 megs! You never know when you need Chromium, Firefox, AND WebKit!"

DETECTIVE (pinching bridge of nose) "These are TEST browsers. For automated testing. Cached. Just sitting there."

[Turns to Homebrew Harry]

DETECTIVE "And you, Harry? 264 megs of what?"

HOMEBREW HARRY (shrugging) "Package installers, son. I keep the downloads. Just in case you want to reinstall something. From 2022."

DETECTIVE (to audience) "Here's the thing about cache, students. It's SUPPOSED to make things faster - keep local copies so you don't re-download. But cache is like a storage unit. It grows and grows, and nobody ever cleans it. And the beautiful thing? IT'S SAFE TO DELETE. These programs will just rebuild it if they need to."

[A fourth figure emerges from shadows]

NPM NANCY - Wearing a jacket covered in npm logos

DETECTIVE "Nancy. One point eight gigs. Npm cache."

NPM NANCY "Every package I ever installed! Every tarball! What if I need to install Express 4.17.1 again offline?"

DETECTIVE "When was the last time you installed something offline?"

NPM NANCY (pause) "...2019?"

DETECTIVE (shaking head) "npm cache clean --force. Remember that command, students."

SCENE 4: "THE SNAP TRAP" - The System Packages

[Detective walks through a warehouse filled with old boxes labeled "GNOME 42", "GNOME 46", "Chromium Rev 1000", etc.]

DETECTIVE "The /snap directory. Seven point four gigs. This was the big one."

[Runs sudo du -h --max-depth=1 /snap | sort -hr | head -15]

7.4G  /snap
3.1G  /snap/gnome-46-2404
1.2G  /snap/gnome-42-2204
788M  /snap/chromium

[An OLD MAN sits in a rocking chair - GNOME GRANDPA v42]

GNOME GRANDPA v42 "I'm not leaving! I still work! What if someone needs to roll back?"

DETECTIVE "Sir, GNOME 46 has been out for months. You're version 42. Nobody's using you."

[GNOME 46, a young vibrant version, waves from across the warehouse]

GNOME 46 "I've got all his features plus more, Detective!"

DETECTIVE (to audience) "This is the snap system's safety mechanism. Ubuntu keeps old versions in case updates break things. Smart? Yes. But expensive? VERY. Between two GNOME versions, that's 4.3 gigs."

[Detective opens another door - reveals SNAP CACHE]

DETECTIVE "And here's the snap cache. Another 716 megs. Backups of backups."

[Runs sudo du -sh /var/lib/snapd/cache]

716M  /var/lib/snapd/cache

DETECTIVE (to audience) "Lesson four: Package managers are pack rats. They keep old versions for safety. You can clean them with snap remove --revision <old-number>. But be careful - don't remove current versions. Safety first."

ACT 3: THE SOLUTION

SCENE 5: "BUILDING THE CASE" - The Evidence Board

[Detective stands before a massive cork board covered in papers, photos of directories, strings connecting evidence. Dramatic overhead light.]

DETECTIVE (pointing at board) "Let's review what we know."

[Points to different sections of the board as spotlight hits each one]

MAJOR SUSPECTS:

1. SNAP PACKAGES - 7.4 GB "- Two GNOME versions hogging 4.3 GB

Old Chromium snapshots
716 MB cache of old revisions"

2. USER CACHE - 2.5 GB "- Puppeteer: 1.2 GB of test browsers

Playwright: 901 MB more browsers
Homebrew: 264 MB of installer packages
Neovim: 94 MB (small but adds up)"

3. NPM CACHE - 1.8 GB "- Every package tarball ever downloaded

Haven't been cleaned since... ever?"

4. LOGS - 154 MB "- Journal logs: System's diary, 154 MB

Not huge, but why keep everything forever?"

5. TMP DIRECTORY - 472 MB "- Supposed to be temporary

Narrator: It was not temporary"

6. APT CACHE - ~220 MB "- Debian package cache in /var/lib/apt/lists"

DETECTIVE (turning to camera) "But notice who's NOT on the board? Node_modules. Only 697 MB total, and they're NEEDED for running applications. We leave them alone."

DETECTIVE "The investigation taught us something, students. The obvious suspect isn't always guilty. You have to follow the evidence."

[Detective picks up red marker, circles the board]

DETECTIVE "Total recovery potential? FOUR TO FIVE GIGABYTES. That's going from 2.2 GB free to 6-7 GB free. From gasping for air to breathing easy."

SCENE 6: "JUSTICE SERVED" - The Cleanup Plan

[Detective sits at desk, typewriter in front. Types up the cleanup plan. Each key press makes a satisfying CLACK.]

DETECTIVE "Every good investigation ends with justice. Here's the cleanup plan."

[Paper rolls out of typewriter]

THE CLEANUP WARRANT
===================

TARGET #1: NPM Cache (1.8 GB)
Command: npm cache clean --force
Risk Level: ZERO - Will rebuild if needed
Expected Recovery: 1.8 GB

TARGET #2: Puppeteer Cache (1.2 GB)
Command: rm -rf ~/.cache/puppeteer
Risk Level: LOW - Will re-download if tests need it
Expected Recovery: 1.2 GB

TARGET #3: Playwright Cache (901 MB)
Command: rm -rf ~/.cache/ms-playwright
Risk Level: LOW - Will re-download if needed
Expected Recovery: 901 MB

TARGET #4: Homebrew Cache (264 MB)
Command: rm -rf ~/.cache/Homebrew
Risk Level: ZERO - Just installers
Expected Recovery: 264 MB

TARGET #5: Old Snap Versions (716 MB)
Command: sudo sh -c 'snap list --all | while read snap ver rev trk pub notes; do if [[ $notes == *disabled* ]]; then snap remove "$snap" --revision="$rev"; fi; done'
Risk Level: LOW - Keeps current versions
Expected Recovery: 716 MB + old package space

TARGET #6: Journal Logs (154 MB → 50 MB)
Command: sudo journalctl --vacuum-size=50M
Risk Level: ZERO - Keeps recent logs
Expected Recovery: ~100 MB

TARGET #7: Tmp Directory (472 MB)
Command: sudo rm -rf /tmp/*
Risk Level: LOW - Should be temporary anyway
Expected Recovery: 472 MB

TARGET #8: Apt Cache
Command: sudo apt-get clean
Risk Level: ZERO - Just package cache
Expected Recovery: ~220 MB

DETECTIVE (standing, putting on hat) "That's how you do it, students. Investigate first. Measure everything. Identify safe targets. Then clean with precision."

[Walks to door, stops, looks back]

DETECTIVE (to audience) "Remember the principles:"

[Holds up fingers, counting]

ONE: "Start broad with df -h, then narrow down with du"

TWO: "Parallelize independent searches. Time is precious."

THREE: "Sort and limit your output. sort -hr | head is your best friend."

FOUR: "Don't assume. The obvious suspect might be innocent."

FIVE: "Cache is usually safe to delete. Old package versions less so, but often safe."

SIX: "Never delete what you don't understand. Measure first. Research second. Delete third."

SEVEN: "Document your findings. Make a plan. Then execute."

[Tips hat]

DETECTIVE "The disk was dying at 89%. But with investigation, methodology, and the right commands? We brought it back from the brink."

[Thunder crashes outside. Rain continues to fall.]

DETECTIVE (narrating as walks out) "The machine would live another day. The user got their answer. And somewhere out there, another disk was filling up, another mystery waiting to be solved."

[Door closes. Sound of footsteps fading.]

DETECTIVE (voiceover, distant) "In the world of system administration, the case is never really closed. Cache fills up again. Logs grow back. Snaps install updates. But now you know how to handle it."

[Screen fades to terminal prompt]

ubuntu@machine:~$ df -h
Filesystem       Size  Used Avail Use% Mounted on
/dev/root         19G   12G  6.8G  64% /

[Saxophone music swells]

THE END

EDUCATIONAL RECAP - "THE DETECTIVE'S TOOLKIT"

For Students Who Want the Commands Without the Noir:

Investigation Phase:

# 1. Check total disk space
df -h

# 2. Find big directories (parallel searches)
du -h --max-depth=1 /home | sort -hr | head -20
sudo du -h --max-depth=1 / | sort -hr | head -20
du -h --max-depth=1 ~/.cache | sort -hr

# 3. Find specific file types
find /home -type d -name "node_modules"
find /home -name "*.log" -o -name "*.dump"

# 4. Check system caches
sudo du -h --max-depth=2 /var/lib | sort -hr | head -20
sudo journalctl --disk-usage

Cleanup Phase (Safe Operations):

# Clear npm cache
npm cache clean --force

# Clear yarn cache (if you use yarn)
yarn cache clean

# Clear apt cache
sudo apt-get clean
sudo apt-get autoclean

# Vacuum journal logs to 50MB
sudo journalctl --vacuum-size=50M

# Clear user caches (be selective!)
rm -rf ~/.cache/Homebrew
rm -rf ~/.cache/puppeteer
rm -rf ~/.cache/ms-playwright

# Remove old snap revisions (disabled versions only)
sudo sh -c 'snap list --all | while read snap ver rev trk pub notes; do
  if [[ $notes == *disabled* ]]; then
    snap remove "$snap" --revision="$rev"
  fi
done'

# Clean tmp (careful - check nothing is actively using it)
sudo rm -rf /tmp/*

Key Lessons:

Start broad, then narrow - df → du at root → du in specific dirs
Parallelize when possible - Multiple independent du commands at once
Sort and limit output - sort -hr | head -20 makes data manageable
Don't assume - Measure before blaming (node_modules was innocent!)
Cache is usually safe - npm, apt, browser caches can be cleared
Package managers hoard - Old snap/apt packages can often be removed
Document before acting - Make a plan with expected recovery amounts

Flags to Remember:

-h : Human-readable sizes (GB not bytes)
-r : Reverse sort (biggest first)
--max-depth=N : Don't recurse too deep
--disk-usage : Check log sizes
--vacuum-size= : Trim logs to size
sort -hr : Sort by size, human-readable, reverse
head -N : Show only first N results

EPILOGUE: "JUSTICE SERVED"

[Several minutes later. Detective Claude returns to the scene. The rain has stopped. A single beam of sunlight breaks through the clouds.]

DETECTIVE (walking back into the office, dusting off hands) "The cleanup is complete. Time to check the results."

[Types df -h. New output appears on the chalkboard]

Filesystem       Size  Used Avail Use% Mounted on
/dev/root         19G   12G  7.0G  63% /

[Camera zooms in on the numbers. Triumphant saxophone music plays.]

DETECTIVE (turning to camera, slight smile) "Twelve gigs used. Seven point oh gigs available. Sixty-three percent."

[Removes sunglasses]

"We recovered five gigabytes. FIVE. The machine went from 2.2 GB free to 7.0 GB free. That's not just an improvement, students - that's a resurrection."

THE ACTUAL CLEANUP REPORT:

BEFORE THE CLEANUP:

Used: 17G
Available: 2.2G
Usage: 89% - CRITICAL

AFTER THE CLEANUP:

Used: 12G
Available: 7.0G
Usage: 63% - HEALTHY

WHAT WE ACTUALLY REMOVED:

✅ npm cache: 1.8 GB - Cleaned completely ✅ Puppeteer cache: 1.2 GB - All test browsers removed ✅ Playwright cache: 901 MB - Gone without a trace ✅ Homebrew cache: 264 MB - Package installers deleted ✅ Old snap revisions: 5 disabled versions removed

chromium revision 3306
core22 revision 2140
cups revision 1128
gnome-46-2404 revision 126
snapd revision 25205 ✅ Journal logs: 105.7 MB freed (vacuumed to 50MB limit) ✅ /tmp directory: 472 MB - Completely cleared ⚠️ apt cache: Skipped (sources.list error - minor impact)

TOTAL SPACE RECOVERED: 4.8 GB (Close enough to our 5GB estimate - detective work at its finest!)

DETECTIVE (to audience) "Notice something? Our estimate was four to five gigs. We recovered 4.8. That's accuracy. That's what happens when you measure first, act second."

[Puts on hat, prepares to leave]

DETECTIVE "The node_modules we suspected? Still there. Still innocent. Only 697 megs, and needed for the applications. We left them untouched."

[Walks to the door, hand on doorknob]

DETECTIVE (final words to camera) "Remember this case, students. The user came with a simple question: 'How much disk space do we have?' But the real question was: 'How do we get more?'"

[Opens door, light streams in]

"And now they do. From 89% to 63%. From critical to comfortable. From 2.2GB to 7GB. Triple the breathing room."

[Tips hat one final time]

"That's detective work. That's system administration. That's how you save a dying disk."

[Walks out into the sunlight. Door closes.]

NARRATOR (voiceover) "The disk space detective closed another case that day. The machine lived on. The cache directories would grow back, as they always do. But now, the user knew how to handle it. They had the commands. They had the methodology. They had... the knowledge."

[Screen fades to black, then text appears]

LESSONS LEARNED:
✓ Investigation over assumption
✓ Measurement before action
✓ Parallel execution for speed
✓ Sort and filter for clarity
✓ Safety first, always

SPACE RECOVERED: 4.8 GB
CASE STATUS: CLOSED

FADE OUT

The disk space detective will return in: "The Case of the Memory Leak"

The Disk Space Detective