The filesystem hierarchy

Why it matters

When a service misbehaves on a server, the questions are always the same: where is its configuration, where are its logs, and which program is actually running? On Linux the answers follow a shared map called the Filesystem Hierarchy StandardThe shared map of where things live on Linux, such as config in /etc and logs in /var/log; FHS. (FHS). Once you know the map, you can find your way around almost any Linux machine, including one you have never seen before.

One tree, starting at /

Windows has drive letters (C:\, D:\). Linux has a single tree that starts at the root directoryThe top of the single Linux directory tree, written /., written /. Extra disks, USB drives and network shares are mountedAttached into the directory tree at a folder, which is how extra disks and drives appear on Linux instead of drive letters. somewhere inside that tree instead of getting their own letter. Run ls / and you will see the top level.

A useful rule of thumb: config in /etc, changing data and logs in /var, programs in /usr, people in /home.

"Everything is a file"

Linux exposes a lot of the system as files. Your disk is /dev/sda (or /dev/vda in many VMs). /dev/null is a black hole that discards whatever is written to it. /proc/meminfo is not stored on disk at all: the kernel generates its contents when you read it.

cat /proc/cpuinfo | grep "model name" | head -1
cat /proc/meminfo | head -3

This is why so many admin tasks come down to reading or editing a text file.

Finding things

Where is a program?

which python3          # path of the command your shell would run
type ls                # also shows aliases and shell built-ins

which python3 prints something like /usr/bin/python3.

Where is a config file?

Configuration for a program is usually in /etc/<program> or /etc/<program>.conf:

ls /etc/ssh/
ls /etc | head -30

When you do not know the name, search by name with find. Searching system folders produces "Permission denied" noise for folders you cannot read, so send errors to /dev/null:

find /etc -name "*.conf" 2>/dev/null | head
find / -name "sshd_config" 2>/dev/null

Where are the logs?

Traditional text logs live in /var/log:

ls -lh /var/log

On Ubuntu you will see syslog, auth.log (logins and sudo), dpkg.log (package installs) and folders for individual services. Many systems also keep logs in the systemd journal, which a later lesson covers.

What is using my disk?

df -h                       # free space per mounted filesystem
du -sh /var/log             # total size of one folder
sudo du -sh /var/* 2>/dev/null | sort -h | tail -5

df answers "how full is each disk?" and du answers "which folder is big?". A full disk is one of the most common causes of a broken server, and /var/log is a frequent culprit.

Absolute and relative paths, again

An absolute pathA path that starts at / and works from any current folder, such as /etc/hosts. starts at / and works from anywhere: /etc/hosts. A relative pathA path interpreted from the current folder, such as ../notes.txt. starts from your current folder: ../notes.txt. In scripts and config files, prefer absolute paths, because the "current folder" of a script run by a scheduler is often not what you expect.

Common mistakes

• Editing files in /usr. Package updates overwrite them. Put local configuration in /etc and your own scripts in /usr/local/bin or your home folder.
• Deleting files in /var/log to free space while a service has them open. The space is not freed until the service restarts. Use the log rotation and journal tools you will meet later instead.
• Treating /tmp as storage. It can be wiped at reboot.
• Running find / without silencing errors, then missing the real result in a wall of "Permission denied".

Recap

• Linux has one tree rooted at /; extra drives are mounted into it.
• Config lives in /etc, logs and changing data in /var, programs in /usr, users in /home.
• /proc, /sys and /dev expose the kernel and devices as files.
• which, find, ls /var/log, df -h and du -sh find programs, configs, logs and disk hogs.

Try it

The Do tab has a scavenger hunt through your practice system's filesystem.