Improve Chapter 01 units lesson

docs/lessons/01_where_to_start/1.06_units.md

@@ -1,64 +1,218 @@
 ## 1.06 Units
 
+Linux administrators read numbers constantly: file sizes, disk capacity,
+memory pressure, network throughput, inode counts, timeouts, process IDs, and
+exit codes. A number without its unit is easy to misread. A number with the
+wrong unit can lead to the wrong operational decision.
 
+This lesson focuses on the units you will see first when inspecting Linux
+systems.
 
 !!! abstract "What you will learn"
-    - Explain where **1.06 Units** fits in day-to-day Linux operations.
-    - Use current Linux tooling to inspect, change, and verify the relevant system behavior.
-    - Connect the concept to a real operational scenario: a first-week junior admin onboarding into a small cloud team.
-
-!!! example "Field story"
-    Imagine a first-week junior admin onboarding into a small cloud team. Your job is not to memorize a command; it is to build a short evidence trail, choose a low-risk change, and prove whether the system improved.
+    - Distinguish bytes, bits, decimal units, and binary units.
+    - Read common size output from `ls`, `du`, `df`, `free`, and `ip`.
+    - Explain why two tools may report different-looking numbers for the same resource.
+    - Record units clearly in troubleshooting notes and handoffs.
 
 !!! success "Operator principle"
-    Identify the OS, distribution, support window, and package source before changing anything.
+    Always copy the number and the unit together. `500` is not evidence; `500 MiB
+    available` is evidence.
 
-## Hands-on practice
+## Bytes and bits
 
-Run these on a disposable VM, container, or lab machine unless the lesson explicitly says otherwise.
+A **bit** is a single binary value, usually written as `0` or `1`. Network
+speeds are often measured in bits per second.
 
-1. Inspect the current state with a read-only command related to this topic.
-2. Save the command and output in a short lab note.
-3. Make one reversible change or simulate the change in a sandbox.
-4. Re-run the inspection and explain what changed.
+A **byte** is 8 bits. File sizes, disk usage, and memory usage are usually
+shown in bytes or byte-based units.
 
-## Check your understanding
+The capital letter matters:
 
-- What evidence would tell you that this system is healthy?
-- What is the riskiest command in this lesson, and how would you make it safer?
-- How would you explain section 1.6 to a teammate during an incident handoff?
+- `b` often means bits.
+- `B` usually means bytes.
+- `Mb/s` means megabits per second.
+- `MB` means megabytes.
 
+For example, a `100 Mb/s` network link is not the same as `100 MB/s`. Because
+there are 8 bits in a byte, `100 Mb/s` is roughly `12.5 MB/s` before protocol
+overhead.
 
-We engage in conversations yielding bytes, kilobytes, megabytes, gigabytes, and even terabytes every day. But what do these terms truly mean? Comprehending units in Linux is not only crucial for your system administration skills but also serves as the universal language of computation. 🌐💻
+## Decimal and binary size units
 
-You might already know that `1 Kilobyte (KB)` stands for `1024 bytes`. Traditionally, this binary system had been used; however, these definitions can switch to the decimal system in some contexts (especially in storage devices), meaning `1 KB` will equate to `1000 bytes` in such cases. Confusing, isn't it? 😕
+Storage vendors often use decimal units:
 
-In the Linux world, we adopt a standard called `IEC` to avoid this confusion. Here's a brief intro to this standard:
+- `1 KB` = 1,000 bytes
+- `1 MB` = 1,000 KB
+- `1 GB` = 1,000 MB
+- `1 TB` = 1,000 GB
 
-- `1 KiB (Kibibyte)` = `1024 bytes`
-- `1 MiB (Mebibyte)` = `1024 KiB`
-- `1 GiB (Gibibyte)` = `1024 MiB`
-- `1 TiB (Tebibyte)` = `1024 GiB`
+Operating systems and many Linux tools often use binary units:
 
-This `IEC` standard uses the binary system (base 2) and provides clear differentiation from the decimal system (base 10) prevalent in mainstream storage. This way, there's no ambiguity! 😄
+- `1 KiB` = 1,024 bytes
+- `1 MiB` = 1,024 KiB
+- `1 GiB` = 1,024 MiB
+- `1 TiB` = 1,024 GiB
 
-There is another essential unit in the Linux world - the `bit`. A `bit` is the most basic unit of information in computing and digital communications. The name is a portmanteau of `binary digit`. The `bit` represents a logical state with one of two possible values. These values are most commonly represented as either "1" or "0".
+This is one reason a disk sold as `500 GB` does not appear as exactly `500 GiB`
+inside Linux. The disk did not lose space; the tools are using different unit
+families.
 
-Now, let’s put this knowledge into practice! 😎
+## Reading file sizes
 
-The `du` (disk usage) command in Linux calculates the file and directory size in blocks by default, and its `-h` (human-readable) option can show sizes in `KB`, `MB`, `GB`.
+Use `ls -lh` when you want a quick human-readable file listing:
 
 ```bash
-$ du -h ~/linux-with-ease.txt
-4.0K    /home/user/linux-with-ease.txt
+ls -lh /var/log/syslog
+```
+
+Example output:
+
+```text
+-rw-r----- 1 syslog adm 42M May 14 10:15 /var/log/syslog
 ```
 
-The `free` command allows you to see the amount of free and used memory in your system.
+The important evidence is `42M`, but `ls` alone does not tell you whether the
+file is causing filesystem pressure. For that, inspect the filesystem.
+
+## Reading filesystem capacity
+
+Use `df -h` to inspect mounted filesystems:
 
 ```bash
-$ free -h
-              total        used        free      shared  buff/cache   available
-Mem:           7.7Gi       3.0Gi       2.0Gi       282Mi       2.7Gi       4.2Gi
+df -h /
+```
+
+Example output:
+
+```text
+Filesystem      Size  Used Avail Use% Mounted on
+/dev/nvme0n1p2   98G   76G   17G  82% /
+```
+
+In an incident note, write the value with context:
+
+```text
+Root filesystem was 82% used with 17G available.
+```
+
+That is more useful than writing:
+
+```text
+Disk looked okay.
+```
+
+## Reading directory usage
+
+Use `du -sh` when you want the total size of a directory tree:
+
+```bash
+du -sh /var/log
+```
+
+Example output:
+
+```text
+1.8G    /var/log
+```
+
+`df` and `du` answer different questions:
+
+- `df` reports filesystem capacity and free space.
+- `du` reports how much space files under a path appear to use.
+
+If `df` says a filesystem is full but `du` does not explain the usage, common
+causes include deleted-but-open files, mount points hiding data, snapshots, or
+reserved filesystem blocks.
+
+## Reading memory units
+
+Use `free -h` for a first look at memory:
+
+```bash
+free -h
+```
+
+Example output:
+
+```text
+               total        used        free      shared  buff/cache   available
+Mem:           7.7Gi       3.1Gi       1.2Gi       210Mi       3.4Gi       4.1Gi
 Swap:          2.0Gi          0B       2.0Gi
 ```
-With this foundational understanding of `units`, you can now easily gauge the scale of files, the capacity of your storage, and the status of your system's memory. Go ahead and explore this further, play with commands, and get a feel for it. Don’t forget, practice makes perfect! 💪🚀
+
+The `available` column is usually more useful than `free`. Linux uses memory for
+cache when it can, and cached memory can often be reclaimed when applications
+need it.
+
+A better handoff note is:
+
+```text
+Memory pressure was not obvious: 4.1Gi available and swap unused.
+```
+
+## Reading network rates
+
+Network tools may show packet counts, byte counts, or bit rates. Be explicit
+about what you captured.
+
+```bash
+ip -s link show dev eth0
+```
+
+Example excerpt:
+
+```text
+RX:  bytes packets errors dropped  missed   mcast
+  87234119   70321      0       0       0       0
+TX:  bytes packets errors dropped carrier collsns
+  22103490   21904      0       0       0       0
+```
+
+This output shows cumulative byte and packet counters, not current bandwidth.
+For current transfer rate, use a tool designed for rate measurement, such as
+`sar`, `iftop`, `nload`, or interface metrics from your monitoring system.
+
+## Other common units
+
+You will also see:
+
+- Time: `ms`, `s`, `min`, `h`, `d`
+- CPU: percent usage, load average, core count
+- Frequency: `Hz`, `MHz`, `GHz`
+- Process and file limits: counts, not bytes
+- Exit status: numeric return codes, where `0` usually means success
+
+Do not assume every number on a Linux system is a size. Read the column label,
+manual page, or tool help before acting.
+
+## Lab: compare units safely
+
+Run these commands on a lab system:
+
+```bash
+ls -lh /bin/ls
+du -h /bin/ls
+df -h /
+free -h
+```
+
+Record:
+
+1. The exact command you ran.
+2. The number and unit from the output.
+3. What resource the number describes.
+4. Whether the command reported a file, directory, filesystem, or memory value.
+
+Then answer this question:
+
+```text
+Which command would you use to decide whether the root filesystem is close to full?
+```
+
+## Check your understanding
+
+- Why is `100 Mb/s` not the same as `100 MB/s`?
+- Why might a `500 GB` disk appear as less than `500 GiB` in Linux?
+- What is the difference between `df -h /` and `du -sh /var/log`?
+- In `free -h`, why is `available` often more useful than `free`?
+- What should you include when copying a numeric value into an incident handoff?