The filesystem hierarchy

Why it matters

When a service misbehaves on a server, the questions are always the same: where is its configuration, where are its logs, and which program is actually running? On Linux the answers follow a shared map called the Filesystem Hierarchy Standard (FHS). Once you know the map, you can find your way around almost any Linux machine, including one you have never seen before.

One tree, starting at /

Windows has drive letters (C:\, D:\). Linux has a single tree that starts at the root directory, written /. Extra disks, USB drives and network shares are mounted somewhere inside that tree instead of getting their own letter. Run ls / and you will see the top level.

A useful rule of thumb: config in /etc, changing data and logs in /var, programs in /usr, people in /home.

"Everything is a file"

Linux exposes a lot of the system as files. Your disk is /dev/sda (or /dev/vda in many VMs). /dev/null is a black hole that discards whatever is written to it. /proc/meminfo is not stored on disk at all: the kernel generates its contents when you read it.

cat /proc/cpuinfo | grep "model name" | head -1
cat /proc/meminfo | head -3

This is why so many admin tasks come down to reading or editing a text file.

Finding things

Where is a program?

which python3          # path of the command your shell would run
type ls                # also shows aliases and shell built-ins

which python3 prints something like /usr/bin/python3.

Where is a config file?

Configuration for a program is usually in /etc/<program> or /etc/<program>.conf:

ls /etc/ssh/
ls /etc | head -30

When you do not know the name, search by name with find. Searching system folders produces "Permission denied" noise for folders you cannot read, so send errors to /dev/null:

find /etc -name "*.conf" 2>/dev/null | head
find / -name "sshd_config" 2>/dev/null

Where are the logs?

Traditional text logs live in /var/log:

ls -lh /var/log

On Ubuntu you will see syslog, auth.log (logins and sudo), dpkg.log (package installs) and folders for individual services. Many systems also keep logs in the systemd journal, which a later lesson covers.

What is using my disk?

df -h                       # free space per mounted filesystem
du -sh /var/log             # total size of one folder
sudo du -sh /var/* 2>/dev/null | sort -h | tail -5

df answers "how full is each disk?" and du answers "which folder is big?". A full disk is one of the most common causes of a broken server, and /var/log is a frequent culprit.

Absolute and relative paths, again

An absolute path starts at / and works from anywhere: /etc/hosts. A relative path starts from your current folder: ../notes.txt. In scripts and config files, prefer absolute paths, because the "current folder" of a script run by a scheduler is often not what you expect.

Common mistakes

• Editing files in /usr. Package updates overwrite them. Put local configuration in /etc and your own scripts in /usr/local/bin or your home folder.
• Deleting files in /var/log to free space while a service has them open. The space is not freed until the service restarts. Use the log rotation and journal tools you will meet later instead.
• Treating /tmp as storage. It can be wiped at reboot.
• Running find / without silencing errors, then missing the real result in a wall of "Permission denied".

Recap

• Linux has one tree rooted at /; extra drives are mounted into it.
• Config lives in /etc, logs and changing data in /var, programs in /usr, users in /home.
• /proc, /sys and /dev expose the kernel and devices as files.
• which, find, ls /var/log, df -h and du -sh find programs, configs, logs and disk hogs.

Try it

The Do tab has a scavenger hunt through your practice system's filesystem.