LFCA 10 🐧 Important Directories Explained

Chapter 9 covered the whole filesystem tree. This chapter goes deeper — into the specific directories you’ll use every day and the files inside them that matter most. Knowing that /etc holds configs is one thing; knowing that /etc/passwd, /etc/fstab, and /etc/hosts are the ones you’ll actually edit is another. This chapter picks the ten directories you interact with constantly, explains their contents, and shows the commands you’ll use to work with them.

Key point: Not every directory is equal. A handful — /etc, /var/log, /home, /usr/bin, /proc, /dev, /boot, /tmp, /var/lib, and /root — cover almost everything a sysadmin does. Knowing what’s inside each, and which files matter, is the practical skill the LFCA exam tests.

---

/etc — where configuration lives

/etc is the most important directory for a sysadmin. Every system-wide configuration file lives here.

Key files:

File	Purpose
/etc/passwd	User accounts — name, UID, GID, home, shell
/etc/shadow	Password hashes (root only)
/etc/group	Group definitions
/etc/hosts	Static hostname resolution
/etc/resolv.conf	DNS server config
/etc/fstab	Filesystems to mount at boot
/etc/hostname	Machine name
/etc/sudoers	Sudo rules (edit with visudo)
/etc/ssh/sshd_config	SSH server config
/etc/os-release	Distribution info

Reading /etc/passwd:

grep alice /etc/passwd
# alice:x:1000:1000:Alice:/home/alice:/bin/bash
#   ↑   ↑  ↑    ↑   ↑      ↑            ↑
# user  pw UID GID info   home         shell

The x in the password field means the hash is in /etc/shadow. That’s why /etc/passwd is world-readable but /etc/shadow isn’t.

Reading /etc/fstab:

UUID=abc...   /         ext4   defaults   0 1
UUID=def...   /boot/efi vfat   umask=0077 0 1
/dev/sdb1     /mnt/data ext4   defaults   0 2

Each line: device, mount point, filesystem, options, dump, fsck order.

Subdirectories:

• /etc/ssh/ — SSH client and server config
• /etc/nginx/ — Nginx config
• /etc/systemd/ — init system config
• /etc/apt/ — package manager config
• /etc/netplan/ — network config (Ubuntu)
• /etc/cron.d/ — cron job drop-ins

Why /etc matters: Configuration defines behavior. Broken configs break services. Backing up /etc and reading it before editing is the first habit of every sysadmin.

Why files, not a registry: Linux uses plain text files for configuration. They’re readable, diff-able, version-controllable, and editable with any tool. This is the opposite of Windows’ binary registry — and one of Linux’s greatest strengths.

---

/var/log — where logs live

/var/log holds system and application logs. When something goes wrong, this is the first place to look.

Key log files:

File	Contains
/var/log/syslog	General system log (Debian family)
/var/log/messages	General system log (Red Hat family)
/var/log/auth.log	Authentication events
/var/log/kern.log	Kernel messages
/var/log/dpkg.log	Package manager operations
/var/log/boot.log	Boot messages
/var/log/journal/	systemd journal (binary)
/var/log/nginx/	Web server logs
/var/log/apt/	APT history

Reading logs:

# Tail the general log
sudo tail -f /var/log/syslog

# Search for errors
sudo grep -i error /var/log/syslog

# Authentication failures
sudo grep "Failed password" /var/log/auth.log

# Package operations
less /var/log/dpkg.log

The systemd journal: Modern systems use journalctl for logs.

journalctl -b              # this boot
journalctl -b -p err       # errors only
journalctl -u nginx        # specific service
journalctl --since "1 hour ago"
journalctl -f              # follow

Log rotation: Logs grow. logrotate rotates and compresses them.

ls /etc/logrotate.d/       # per-package configs
cat /etc/logrotate.conf    # global config

Rotated logs get suffixes: .1, .2, .gz. The current log is .log, older ones are .log.1, .log.2.gz, etc.

Why /var/log matters: It’s the record of what happened. Crashes, login attempts, service failures, package installs — all logged. Debugging starts here.

Why logs are separate from /etc: Configuration is static; logs are dynamic. /etc is small and rarely changes; /var/log grows constantly. Keeping them in different trees lets /var have its own partition and log-specific cleanup rules.

---

/home and /root — user space

User data lives in /home. Root’s home is /root.

/home structure:

/home/alice/
├── Documents/
├── Downloads/
├── .bashrc            ← shell config
├── .profile           ← login config
├── .config/           ← app configs
├── .ssh/              ← SSH keys
│   ├── id_rsa
│   ├── id_rsa.pub
│   └── known_hosts
└── .local/            ← local data

Key dot files:

File	Purpose
.bashrc	Bash config for interactive shells
.profile	Login-time environment
.bash_history	Command history
.ssh/	SSH keys and config
.gitconfig	Git user config
.vimrc	Vim config
.config/	Modern app configs (XDG)

Permissions: Each user’s home is private by default.

ls -ld /home/alice
# drwxr-xr-x 3 alice alice 4096 ... /home/alice

Only alice and root can write.

Root’s home — /root:

sudo ls -la /root
# root's files, scripts, configs

Root’s home is on the root filesystem — available even if /home isn’t mounted.

Backing up home directories:

tar czf alice-home.tar.gz /home/alice

Why home directories matter: They hold everything that makes a system “yours” — files, keys, preferences. Losing /home loses user data. Migrating a user between systems means migrating their home directory.

Why dot files: Files starting with . are hidden by default (ls hides them; ls -a shows them). Historically, this kept config files out of the way. Modern practice puts them in ~/.config/ (XDG Base Directory spec), but the old flat layout persists for many tools.

---

/usr/bin and /usr/sbin — where programs live

Most executables are in /usr/bin and /usr/sbin.

/usr/bin — user commands:

which ls cat grep
# /usr/bin/ls
# /usr/bin/cat
# /usr/bin/grep

ls /usr/bin | wc -l
# 2000+

/usr/sbin — system commands:

which fdisk mount reboot
# /usr/sbin/fdisk
# /usr/bin/mount
# /usr/sbin/reboot

The $PATH: When you type a command, the shell searches $PATH for it.

echo $PATH
# /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Directories are searched left to right. /usr/local/bin comes first — so a locally installed tool overrides a packaged one.

Finding commands:

which COMMAND       # first match in PATH
type COMMAND        # shell built-in or binary
whereis COMMAND     # all locations
command -v COMMAND  # POSIX-compliant

Binaries vs scripts: Most files in /usr/bin are ELF binaries. Some are scripts (shell, Python). Both are executable.

file /usr/bin/ls
# ELF 64-bit LSB executable ...

file /usr/bin/ldd
# POSIX shell script ...

Why these directories matter: This is where commands come from. When you type ls, grep, or systemctl, the shell finds the binary here. Understanding $PATH explains why some commands work and others “aren’t found.”

Why /usr/local/bin is first: It’s reserved for tools the admin installs manually. Putting it first in $PATH lets local installs override packaged ones without replacing files in /usr/bin. It’s how you run a newer version of a tool without breaking the package manager’s version.

---

/proc — process and kernel info

/proc is a virtual filesystem. It doesn’t exist on disk — the kernel generates it on demand.

Key files:

File	Contains
/proc/cpuinfo	CPU details
/proc/meminfo	Memory info
/proc/version	Kernel version
/proc/uptime	System uptime
/proc/loadavg	Load average
/proc/filesystems	Supported filesystems
/proc/mounts	Current mounts
/proc/PID/	Per-process info

Per-process directories:

ls /proc/ | grep '^[0-9]'
# 1  10  100  1000 ...

ls /proc/1/
# cmdline  cwd  environ  exe  fd  status  ...

Each running process gets /proc/PID.

Reading process info:

cat /proc/1/cmdline | tr '\0' ' '
# /sbin/init splash

cat /proc/1/status | head -5
# Name:   systemd
# Umask:  0022
# State:  S (sleeping)

System info:

cat /proc/cpuinfo | grep "model name" | head -1
cat /proc/meminfo | head -3
cat /proc/loadavg
# 0.15 0.10 0.05 1/234 5678

/proc/sys — kernel parameters:

cat /proc/sys/net/ipv4/ip_forward
# 0

sudo sysctl -w net.ipv4.ip_forward=1
# enable IP forwarding

sysctl reads and writes kernel tunables through /proc/sys.

Why /proc matters: It exposes the running system as files. CPU, memory, load, processes, kernel parameters — all readable and (some) writable. It’s the standard way to inspect and tune a Linux system.

Why a virtual filesystem: Real files would need to be regenerated constantly. Instead, the kernel implements procfs — reads trigger on-demand generation. To the shell it looks like a directory; to the kernel it’s a function.

---

/dev — device files

/dev holds device files — special files that represent hardware.

Common devices:

Path	Represents
/dev/sda	First SCSI/SATA disk
/dev/sda1	First partition of sda
/dev/nvme0n1	First NVMe disk
/dev/null	Discards everything written
/dev/zero	Produces infinite zero bytes
/dev/random	Random bytes (may block)
/dev/urandom	Random bytes (never blocks)
/dev/tty	Current terminal
/dev/stdin	Standard input
/dev/stdout	Standard output

The /dev/null idiom:

command > /dev/null 2>&1    # suppress all output

Randomness:

head -c 16 /dev/urandom | base64
# random base64 string

Block vs character devices:

• Block devices (b) — read/write in blocks (disks)
• Character devices (c) — read/write byte streams (terminals, random)

ls -l /dev/sda /dev/tty
# brw-rw---- ... /dev/sda
# crw-rw-rw- ... /dev/tty

b = block, c = character.

Why /dev matters: It’s how programs access hardware. To read a disk, read /dev/sda. To generate randomness, read /dev/urandom. To discard output, write to /dev/null. The same file interface handles all of it.

Why “everything is a file” works: Devices look like files because the kernel exposes them that way. cat /dev/urandom and cat /etc/hostname use the same read syscall. Programs don’t need special APIs for hardware — just file operations.

---

/boot — the kernel and bootloader

/boot holds everything needed to boot the system.

Key files:

File	Purpose
vmlinuz-*	The kernel image
initrd.img-*	Initial RAM filesystem
config-*	Kernel build config
System.map-*	Kernel symbol map
grub/	GRUB bootloader
efi/	EFI System Partition (UEFI)

Typical layout:

/boot/
├── vmlinuz-6.8.0-45-generic
├── initrd.img-6.8.0-45-generic
├── config-6.8.0-45-generic
├── System.map-6.8.0-45-generic
├── grub/
│   ├── grub.cfg
│   ├── fonts/
│   └── x86_64-efi/
└── efi/                      ← mount point for EFI System Partition
    └── EFI/
        └── ubuntu/
            └── grubx64.efi

Kernel updates: Package managers install new kernels and update GRUB.

dpkg -l | grep linux-image       # list installed kernels
sudo apt autoremove              # remove old kernels

GRUB config: /boot/grub/grub.cfg is generated — don’t edit directly.

# Edit /etc/default/grub, then regenerate:
sudo update-grub

Why /boot matters: Without it, the system can’t boot. Corrupted kernels or a broken GRUB mean an unbootable system — often recoverable only via rescue media.

Why /boot is often separate: In the BIOS era, the bootloader couldn’t read past the first few GB of a disk. /boot had to be at the start. Modern systems don’t have that limit, but a separate /boot still protects boot files from filling up with user data and keeps them unencrypted on otherwise-encrypted systems.

---

/tmp and /var/tmp — temporary files

Two directories for temporary data, with different lifetimes.

/tmp:

• Cleared on reboot (usually)
• Shared by all users
• Often mounted with noexec, nosuid, nodev for security

/var/tmp:

• Persists across reboots
• Same purpose as /tmp but longer-lived
• Used by applications that need temp data between runs

Creating temp files:

mktemp                 # creates /tmp/tmp.XXXXXX
mktemp -d              # creates a directory
mktemp --tmpdir=/var/tmp

Permissions: /tmp is world-writable but has the sticky bit — users can only delete their own files.

ls -ld /tmp
# drwxrwxrwt ... /tmp
#          ↑ sticky bit

What not to do:

# ❌ Don't store anything important in /tmp
cp important.txt /tmp/

# ❌ Don't use predictable names
echo "data" > /tmp/mytemp     # collision / symlink attack risk

# ✅ Use mktemp
tmpfile=$(mktemp)
echo "data" > "$tmpfile"

Why /tmp matters: Every program needs a place to put scratch data. /tmp is that place — standardized, cleaned up automatically, and safe to use with mktemp.

Why the sticky bit: Without it, any user could delete any file in /tmp — chaos. The sticky bit restricts deletion to the file’s owner. This is a decades-old Unix security feature that still matters.

---

/var/lib — application state

/var/lib holds persistent state for applications — databases, package metadata, service data.

Examples:

Path	Contains
/var/lib/dpkg/	Installed package database (Debian)
/var/lib/apt/	APT package lists
/var/lib/mysql/	MySQL/MariaDB databases
/var/lib/postgresql/	PostgreSQL databases
/var/lib/docker/	Docker images and containers
/var/lib/systemd/	systemd state
/var/lib/cloud/	Cloud-init state
/var/lib/snapd/	Snap packages

Why databases live here: They’re state — changing, application-specific, not user data. /var/lib is the FHS-defined home for it.

Why it matters for backups: /var/lib often needs backing up, especially databases. Losing /var/lib/mysql loses every database on the system.

Why /var/lib matters: It’s where applications keep their state. Not configs (those are in /etc), not logs (/var/log), not user data (/home). State that the app manages and needs across restarts.

Why separate from /etc: Config is what you set. State is what the app generates. A database config goes in /etc/mysql/; the database itself in /var/lib/mysql/. Backing up config and state separately makes sense — one is small and static, the other large and changing.

---

/root — the root user’s home

/root is the home directory for the root user.

Contents:

sudo ls -la /root
# .bashrc  .profile  .ssh/  .bash_history  scripts/  ...

Why not /home/root:

• Available even if /home is on a separate partition that isn’t mounted
• Root needs to log in during recovery — /root is always on the root filesystem
• Historically, root’s home was separate from regular users’

Best practices:

• Don’t store user data in /root — it’s root’s private space
• Don’t work as root for daily tasks — use sudo
• Keep root’s .bashrc minimal
• Root’s .ssh/ may hold the admin’s keys — protect it

Switching to root:

sudo -i              # login shell as root
sudo -s              # non-login shell
sudo su -            # equivalent to sudo -i

Prefer sudo COMMAND over sudo su — it’s more auditable and avoids accidentally running everything as root.

Why /root matters: It’s the admin’s home. When you recover a system, log in as root, or run privileged scripts, this is where you land. It’s small but essential.

Why root needs a home: Even privileged processes expect $HOME to be set. Root’s .bashrc, .vimrc, and .ssh are needed for a usable admin session. Putting them in /root keeps them accessible regardless of the rest of the system.

---

A full example

Exploring the important directories on a running system.

# ============================================
# PART 1: /etc — CONFIGURATION
# ============================================

ls /etc/ | head -10

# Users and groups
grep alice /etc/passwd
grep alice /etc/group

# Hosts and DNS
cat /etc/hostname
cat /etc/hosts
cat /etc/resolv.conf

# Mounts
cat /etc/fstab

# Subdirectories
ls /etc/ssh/
ls /etc/nginx/ 2>/dev/null
ls /etc/systemd/

# ============================================
# PART 2: /var/log — LOGS
# ============================================

ls /var/log/ | head -10

# Recent system log
sudo tail -5 /var/log/syslog 2>/dev/null || \
  sudo tail -5 /var/log/messages

# Auth log
sudo tail -5 /var/log/auth.log 2>/dev/null

# Journal
journalctl -b -p err --no-pager | tail -5

# ============================================
# PART 3: /home and /root
# ============================================

ls /home/
ls -la /home/alice | head -5

# Dot files
cat /home/alice/.bashrc | head -5

# SSH keys
ls -la /home/alice/.ssh/ 2>/dev/null

# Root's home
sudo ls -la /root/ | head -5

# ============================================
# PART 4: /usr/bin — BINARIES
# ============================================

which ls cat grep
which fdisk mount

echo $PATH

# Count binaries
ls /usr/bin | wc -l

# Find what package owns a binary
dpkg -S /usr/bin/ls

# ============================================
# PART 5: /proc — PROCESS AND KERNEL
# ============================================

cat /proc/version
cat /proc/uptime
cat /proc/loadavg
grep "model name" /proc/cpuinfo | head -1
head -3 /proc/meminfo

# Processes
ls /proc/ | grep '^[0-9]' | wc -l

# Specific process
cat /proc/1/status | head -5

# Kernel parameters
cat /proc/sys/net/ipv4/ip_forward

# ============================================
# PART 6: /dev — DEVICES
# ============================================

ls /dev/sd* 2>/dev/null
ls /dev/nvme* 2>/dev/null
ls /dev/tty* | head -3

file /dev/sda 2>/dev/null
file /dev/null

head -c 16 /dev/urandom | base64

# ============================================
# PART 7: /boot — KERNEL
# ============================================

ls /boot/
ls /boot/grub/

uname -r
# matches vmlinuz-* in /boot

# ============================================
# PART 8: /tmp
# ============================================

ls -ld /tmp
# [ drwxrwxrwt ... /tmp ] — sticky bit

tmpfile=$(mktemp)
echo "test" > "$tmpfile"
cat "$tmpfile"
rm "$tmpfile"

# ============================================
# PART 9: /var/lib — STATE
# ============================================

ls /var/lib/ | head -10
ls /var/lib/dpkg/ | head -5
ls /var/lib/apt/ | head -5

# ============================================
# PART 10: SUMMARY
# ============================================

echo "=== System ==="
hostnamectl | head -4

echo "=== Memory ==="
free -h | head -2

echo "=== Disk ==="
df -h | head -3

echo "=== Users ==="
ls /home/

echo "=== Uptime ==="
uptime

The session covers all ten important directories — real contents, real commands, real outputs.

Why this walkthrough: Each directory has a purpose, and this covers them in the order an admin would explore a new system. Seeing the actual files — /etc/passwd, /var/log/syslog, /proc/loadavg, /dev/null — turns abstract knowledge into working skills.

---

Complete Example Session

# ============================================
# PART 1: /etc — READ KEY CONFIGS
# ============================================

head -3 /etc/passwd
# [ root:x:0:0:root:/root:/bin/bash ]
# [ daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin ]
# [ bin:x:2:2:bin:/bin:/usr/sbin/nologin ]

grep $USER /etc/passwd
# [ alice:x:1000:1000:Alice:/home/alice:/bin/bash ]

cat /etc/hostname
# [ myserver ]

head -3 /etc/hosts
# [ 127.0.0.1    localhost ]
# [ 127.0.1.1    myserver ]

head -3 /etc/fstab
# [ # /etc/fstab: static file system information. ]
# [ UUID=abc...  /  ext4  errors=remount-ro  0 1 ]
# [ UUID=def...  /boot/efi  vfat  umask=0077  0 1 ]

# ============================================
# PART 2: /var/log — INSPECT LOGS
# ============================================

ls /var/log/ | wc -l
# [ 34 ]

ls /var/log/ | head -8
# [ alternatives.log  apt  auth.log  btmp  dpkg.log ]
# [ journal  kern.log  lastlog  syslog  wtmp ]

sudo tail -3 /var/log/syslog
# [ (recent messages) ]

sudo grep "Failed password" /var/log/auth.log | tail -3
# [ (failed login attempts, if any) ]

journalctl -b -p err --no-pager | tail -3
# [ (boot errors, if any) ]

# ============================================
# PART 3: /home and /root
# ============================================

ls /home/
# [ alice ]

ls -a /home/alice | head -8
# [ .  ..  .bash_history  .bash_logout  .bashrc ]
# [ .cache  .config  .local  .profile  .ssh ]

ls -la /home/alice/.ssh/
# [ id_rsa  id_rsa.pub  known_hosts ]

sudo ls -la /root/ | head -5
# [ drwx------ ... . ]
# [ -rw-r--r-- ... .bashrc ]
# [ drwx------ ... .ssh ]

# ============================================
# PART 4: /usr/bin — BINARIES
# ============================================

which ls cat grep fdisk mount
# [ /usr/bin/ls ]
# [ /usr/bin/cat ]
# [ /usr/bin/grep ]
# [ /usr/sbin/fdisk ]
# [ /usr/bin/mount ]

echo $PATH | tr ':' '\n'
# [ /usr/local/sbin ]
# [ /usr/local/bin ]
# [ /usr/sbin ]
# [ /usr/bin ]
# [ /sbin ]
# [ /bin ]

ls /usr/bin | wc -l
# [ 2148 ]

# ============================================
# PART 5: /proc — KERNEL INFO
# ============================================

cat /proc/version
# [ Linux version 6.8.0-45-generic ... ]

cat /proc/uptime
# [ 12345.67 98765.43 ]

cat /proc/loadavg
# [ 0.15 0.10 0.05 1/234 5678 ]

grep "model name" /proc/cpuinfo | head -1
# [ model name: AMD Ryzen 5 5600X ... ]

head -3 /proc/meminfo
# [ MemTotal:       16384000 kB ]
# [ MemFree:         8000000 kB ]
# [ MemAvailable:   12000000 kB ]

ls /proc/ | grep '^[0-9]' | wc -l
# [ 187 ]

# ============================================
# PART 6: /dev — DEVICES
# ============================================

ls /dev/sd* 2>/dev/null
# [ /dev/sda  /dev/sda1  /dev/sda2 ]

ls /dev/nvme* 2>/dev/null

file /dev/null /dev/urandom
# [ /dev/null:    character special ]
# [ /dev/urandom: character special ]

head -c 16 /dev/urandom | base64
# [ (random 24-char base64) ]

ls -l /dev/null
# [ crw-rw-rw- 1 root root 1, 3 ... /dev/null ]

# ============================================
# PART 7: /boot — KERNEL
# ============================================

ls /boot/
# [ config-6.8.0-45-generic  grub/ ]
# [ initrd.img-6.8.0-45-generic ]
# [ System.map-6.8.0-45-generic ]
# [ vmlinuz-6.8.0-45-generic ]

ls /boot/grub/
# [ fonts  grub.cfg  grubenv  i386-pc  locale ]
# [ unicode.pf2  x86_64-efi ]

uname -r
# [ 6.8.0-45-generic ]
#   ↑ matches vmlinuz in /boot

# ============================================
# PART 8: /tmp — TEMPORARY
# ============================================

ls -ld /tmp
# [ drwxrwxrwt ... /tmp ]
#          ↑ sticky

tmpfile=$(mktemp)
# [ /tmp/tmp.abc123 ]

echo "temporary" > "$tmpfile"
cat "$tmpfile"
rm "$tmpfile"

# ============================================
# PART 9: /var/lib — STATE
# ============================================

ls /var/lib/ | head -10
# [ apt  dbus  dpkg  git  mysql  pam  systemd ... ]

ls /var/lib/dpkg/ | head -5
# [ alternatives  available  diversions  info  status ]

du -sh /var/lib/mysql/ 2>/dev/null
# [ 500M ]

# ============================================
# PART 10: DISK USAGE BY DIRECTORY
# ============================================

sudo du -sh /etc /var/log /home /usr/bin /boot /var/lib 2>/dev/null
# [ 10M    /etc ]
# [ 200M   /var/log ]
# [ 500M   /home ]
# [ 1.5G   /usr/bin ]
# [ 100M   /boot ]
# [ 3G     /var/lib ]

The session walks through each important directory — reading real files, inspecting real devices, checking real usage.

Why this exercise is the fast path: Instead of memorizing paths, you see the actual files. /etc/passwd shows real users. /var/log/syslog shows real logs. /proc/cpuinfo shows real hardware. The abstract becomes concrete.

---

Quick Reference

The Ten Important Directories

Directory	Purpose
/etc	Configuration
/var/log	Logs
/home	User data
/root	Root’s home
/usr/bin	User binaries
/usr/sbin	System binaries
/proc	Process and kernel info
/dev	Devices
/boot	Kernel and bootloader
/tmp	Temporary files
/var/lib	Application state

Key /etc Files

File	Purpose
passwd	Users
shadow	Password hashes
group	Groups
hosts	Static DNS
resolv.conf	DNS servers
fstab	Mounts at boot
hostname	Machine name
sudoers	Sudo rules
ssh/sshd_config	SSH server
os-release	Distribution

/etc Subdirectories

Path	Purpose
ssh/	SSH config
nginx/	Nginx
systemd/	Init system
apt/	Debian package manager
netplan/	Ubuntu network
cron.d/	Cron jobs

Key /var/log Files

File	Contains
syslog	General (Debian)
messages	General (Red Hat)
auth.log	Authentication
kern.log	Kernel
dpkg.log	Package ops
boot.log	Boot
journal/	systemd journal
nginx/	Web server

Log Commands

Command	Purpose
tail -f LOG	Follow a log
grep PATTERN LOG	Search
journalctl -b	This boot
journalctl -u SVC	Service log
journalctl -p err	Errors only
logrotate	Rotate

Home Directory Files

File	Purpose
.bashrc	Bash config
.profile	Login env
.bash_history	Command history
.ssh/	SSH keys
.gitconfig	Git config
.config/	App configs

/usr/bin vs /usr/sbin

Directory	Content
/usr/bin	User commands
/usr/sbin	Admin commands
/usr/local/bin	Manual installs
/bin	Symlink (usr-merge)
/sbin	Symlink (usr-merge)

/proc Key Files

File	Contains
cpuinfo	CPU info
meminfo	Memory info
version	Kernel version
uptime	Uptime
loadavg	Load average
mounts	Mounts
PID/	Per-process
sys/	Kernel params

/dev Common Devices

Device	Purpose
/dev/sda	First SATA disk
/dev/nvme0n1	First NVMe disk
/dev/null	Discards data
/dev/zero	Infinite zeros
/dev/random	Random (blocks)
/dev/urandom	Random (non-blocking)
/dev/tty	Current terminal

/boot Files

File	Purpose
vmlinuz-*	Kernel
initrd.img-*	Initramfs
config-*	Build config
System.map-*	Symbols
grub/	GRUB config
efi/	UEFI partition

Temp Directories

Directory	Cleared
/tmp	On reboot
/var/tmp	Persists

/var/lib State

Path	Contains
dpkg/	Package DB
apt/	APT lists
mysql/	MySQL data
docker/	Docker data
systemd/	systemd state

Path Symbols

Symbol	Meaning
/	Root
.	Current
..	Parent
~	Home
~user	User’s home
-	Previous (cd -)

Log Levels (syslog)

Level	Meaning
emerg	System unusable
alert	Action needed
crit	Critical
err	Error
warning	Warning
notice	Normal but notable
info	Informational
debug	Debug

File Type Codes

Code	Type
-	Regular file
d	Directory
l	Symlink
b	Block device
c	Character device
s	Socket
p	Pipe

Commands for Exploration

Command	Purpose
ls -la	Detailed listing
file FILE	File type
stat FILE	File metadata
du -sh DIR	Directory size
df -h	Disk usage
which CMD	Command location
type CMD	Shell info
whereis CMD	All locations

Essential Backups

Directory	Frequency
/etc	After config changes
/home	Regularly
/var/lib	Before major updates
Root’s .ssh	After key generation

---

Best Practices

✅ Do This:

# Read /etc before editing
cat /etc/ssh/sshd_config | grep -v '^#'            # ✅

# Use visudo for /etc/sudoers
sudo visudo                                        # ✅

# Back up /etc and /home
sudo tar czf backup.tar.gz /etc /home              # ✅

# Check /var/log when troubleshooting
sudo tail -f /var/log/syslog                       # ✅

# Use journalctl for modern logs
journalctl -u nginx --since "10 min ago"           # ✅

# Use mktemp for temporary files
tmpfile=$(mktemp)                                  # ✅

# Prefer /usr/local/bin for manual installs
sudo cp mytool /usr/local/bin/                     # ✅

# Check /proc for system info
cat /proc/cpuinfo /proc/meminfo                    # ✅

# Backup databases in /var/lib
sudo mysqldump --all-databases > all.sql           # ✅

# Verify $PATH
echo $PATH                                         # ✅

# Protect SSH keys
chmod 600 ~/.ssh/id_rsa                            # ✅

❌ Don’t Do This:

# Don't edit /etc/passwd directly
sudo vim /etc/passwd  # use usermod/adduser        # ❌

# Don't edit /etc/sudoers directly
sudo vim /etc/sudoers  # use visudo                # ❌

# Don't edit grub.cfg directly
sudo vim /boot/grub/grub.cfg  # use update-grub    # ❌

# Don't delete files in /proc, /sys, /dev
rm /proc/1  # kernel crash risk                    # ❌

# Don't use /tmp for permanent data
cp important.txt /tmp/  # cleared on reboot        # ❌

# Don't predict temp file names
echo "x" > /tmp/mytemp  # use mktemp                # ⚠️

# Don't work as root routinely
sudo su -  # use sudo COMMAND instead              # ⚠️

# Don't chmod 777 to "fix" permissions
chmod -R 777 /var/www  # unsafe                   # ❌

# Don't ignore log rotation
# Configure logrotate                              # ❌

# Don't fill /boot with old kernels
sudo apt autoremove                                # ✅

---

Common Pitfalls

Pitfall	Problem	Solution
Editing /etc/passwd directly	Account corruption	Use usermod, adduser
Editing /etc/sudoers directly	Lock out sudo	Use visudo
Editing grub.cfg directly	Regenerated, lost	Edit /etc/default/grub
Storing data in /tmp	Cleared on reboot	Use /home or /var/lib
Ignoring /var/log growth	Disk full	Configure logrotate
Deleting /proc files	Kernel issues	Don’t — virtual
Predictable temp names	Race conditions	Use mktemp
Working as root always	Audit problems	Use sudo
Losing /etc backup	Can’t recover	Back up regularly
Forgetting /var/lib	Data loss	Include in backups

---

Real-World Examples

1. Read the user database

grep $USER /etc/passwd

2. Read the group database

cat /etc/group

3. Check hosts

cat /etc/hosts

4. Check DNS config

cat /etc/resolv.conf

5. Check fstab

cat /etc/fstab

6. Read system log

sudo tail -f /var/log/syslog

7. Read auth log

sudo tail /var/log/auth.log

8. Use journalctl

journalctl -b -p err

9. Inspect a process

cat /proc/$(pgrep nginx | head -1)/cmdline | tr '\0' ' '

10. Check memory

head -3 /proc/meminfo

11. Check load

cat /proc/loadavg

12. Read random bytes

head -c 16 /dev/urandom | xxd

13. Discard output

command > /dev/null 2>&1

14. List kernel files

ls /boot/

15. Create a temp file

tmp=$(mktemp); echo "data" > "$tmp"

16. Check a home directory

ls -la ~

17. Check root’s home

sudo ls -la /root

18. Locate a command

which docker

19. Find package owner

dpkg -S /usr/bin/ls

20. Inspect database state

sudo du -sh /var/lib/mysql/

---

Visual: The Important Directories

┌──────────────────────────────────────────────┐
│  /                                           │
│  ├── etc/       ← config                     │
│  ├── home/      ← user data                  │
│  ├── root/      ← root's home                │
│  ├── var/                                    │
│  │   ├── log/   ← logs                       │
│  │   └── lib/   ← state                      │
│  ├── usr/                                    │
│  │   ├── bin/   ← user binaries              │
│  │   └── sbin/  ← system binaries            │
│  ├── boot/      ← kernel                     │
│  ├── dev/       ← devices                    │
│  ├── proc/      ← kernel info                │
│  └── tmp/       ← temporary                  │
│                                              │
└──────────────────────────────────────────────┘

Visual: /etc at a Glance

┌──────────────────────────────────────────────┐
│  /etc/                                       │
│  │                                           │
│  ├── passwd      who can log in              │
│  ├── shadow      passwords (root only)       │
│  ├── group       groups                      │
│  ├── hosts       static hostnames            │
│  ├── fstab       what mounts at boot         │
│  ├── hostname    machine name                │
│  ├── sudoers     who can sudo                │
│  │                                           │
│  ├── ssh/        sshd_config                 │
│  ├── nginx/      nginx.conf                  │
│  ├── systemd/    system configs              │
│  └── apt/        package manager             │
│                                              │
└──────────────────────────────────────────────┘

Visual: Where Logs Go

┌──────────────────────────────────────────────┐
│  System events    →  /var/log/syslog         │
│  Auth events      →  /var/log/auth.log       │
│  Kernel           →  /var/log/kern.log       │
│  Packages         →  /var/log/dpkg.log       │
│  Boot             →  /var/log/boot.log       │
│  systemd unit     →  journalctl -u UNIT      │
│  Nginx            →  /var/log/nginx/         │
│  APT              →  /var/log/apt/           │
│                                              │
│  Read with: tail, grep, less, journalctl     │
│                                              │
└──────────────────────────────────────────────┘

Visual: User Home Directory

┌──────────────────────────────────────────────┐
│  /home/alice/                                │
│                                              │
│  Documents/          user files              │
│  Downloads/          user files              │
│  Pictures/           user files              │
│                                              │
│  .bashrc             shell config            │
│  .profile            login env               │
│  .bash_history       command history         │
│  .gitconfig          git config              │
│  .config/            modern app configs      │
│  .local/             local data              │
│  .ssh/               SSH keys                │
│    ├── id_rsa        private key             │
│    ├── id_rsa.pub    public key              │
│    └── known_hosts   trusted hosts           │
│                                              │
└──────────────────────────────────────────────┘

Visual: /usr/bin and $PATH

┌──────────────────────────────────────────────┐
│  $PATH = /usr/local/sbin:/usr/local/bin:     │
│          /usr/sbin:/usr/bin:/sbin:/bin       │
│                                              │
│  When you type `ls`:                         │
│                                              │
│  1. Look in /usr/local/sbin/ls    — not found│
│  2. Look in /usr/local/bin/ls     — not found│
│  3. Look in /usr/sbin/ls          — not found│
│  4. Look in /usr/bin/ls           — FOUND    │
│  5. Run /usr/bin/ls                          │
│                                              │
└──────────────────────────────────────────────┘

Visual: /proc Shows Running System

┌──────────────────────────────────────────────┐
│  /proc/                                      │
│  ├── cpuinfo       CPU details               │
│  ├── meminfo       memory state              │
│  ├── loadavg       system load               │
│  ├── uptime        how long running          │
│  ├── version       kernel version            │
│  ├── mounts        current mounts            │
│  ├── 1/            PID 1 (init)              │
│  ├── 1234/         PID 1234                  │
│  │   ├── cmdline                             │
│  │   ├── status                              │
│  │   ├── cwd       → symlink to cwd          │
│  │   └── fd/       open file descriptors     │
│  └── sys/          kernel parameters         │
│                                              │
│  All virtual — generated by the kernel       │
│                                              │
└──────────────────────────────────────────────┘

Visual: /dev Devices

┌──────────────────────────────────────────────┐
│  /dev/sda        →  first SATA disk (block)  │
│  /dev/sda1       →  partition 1              │
│  /dev/nvme0n1    →  first NVMe disk          │
│  /dev/tty        →  current terminal         │
│  /dev/null       →  discards                 │
│  /dev/zero       →  infinite zeros           │
│  /dev/random     →  random (may block)       │
│  /dev/urandom    →  random (fast)            │
│  /dev/stdin      →  stdin                    │
│  /dev/stdout     →  stdout                   │
│                                              │
└──────────────────────────────────────────────┘

Visual: /boot Contents

┌──────────────────────────────────────────────┐
│  /boot/                                      │
│  ├── vmlinuz-6.8.0-45-generic    kernel      │
│  ├── initrd.img-6.8.0-45-generic initramfs   │
│  ├── config-6.8.0-45-generic     build config│
│  ├── System.map-6.8.0-45-generic symbols     │
│  ├── grub/                                   │
│  │   ├── grub.cfg                boot menu   │
│  │   ├── x86_64-efi/             EFI modules │
│  │   └── fonts/                              │
│  └── efi/                        ESP mount   │
│      └── EFI/ubuntu/grubx64.efi              │
│                                              │
└──────────────────────────────────────────────┘

Visual: Temporary File Workflow

┌──────────────────────────────────────────────┐
│  ❌ Predictable name                         │
│                                              │
│  echo "secret" > /tmp/mytemp                 │
│                                              │
│  → Race condition                            │
│  → Symlink attack risk                       │
│                                              │
└──────────────────────────────────────────────┘

┌──────────────────────────────────────────────┐
│  ✅ mktemp                                   │
│                                              │
│  tmp=$(mktemp)                               │
│  echo "secret" > "$tmp"                      │
│  # use $tmp                                  │
│  rm "$tmp"                                   │
│                                              │
│  → Unique name, no collision                 │
│                                              │
└──────────────────────────────────────────────┘

Visual: /var/lib Applications

┌──────────────────────────────────────────────┐
│  /var/lib/                                   │
│  ├── dpkg/         package database          │
│  ├── apt/          package lists             │
│  ├── mysql/        MySQL data                │
│  ├── postgresql/   PostgreSQL data           │
│  ├── docker/       Docker images/containers  │
│  ├── systemd/      systemd state             │
│  ├── cloud/        cloud-init state          │
│  └── snapd/        Snap state                │
│                                              │
│  State, not config — app-managed data        │
│                                              │
└──────────────────────────────────────────────┘

Visual: Root’s Home

┌──────────────────────────────────────────────┐
│  /root/                                      │
│  ├── .bashrc          root's bash config     │
│  ├── .profile         login env              │
│  ├── .bash_history    history                │
│  ├── .ssh/            admin keys             │
│  │   ├── id_rsa                              │
│  │   └── id_rsa.pub                          │
│  └── scripts/         admin scripts          │
│                                              │
│  NOT /home/root — must be available          │
│  even without /home mounted                  │
│                                              │
└──────────────────────────────────────────────┘

Visual: Files by Purpose

┌──────────────────────────────────────────────┐
│  Config      →  /etc                         │
│  Logs        →  /var/log                     │
│  User data   →  /home                        │
│  Root        →  /root                        │
│  Binaries    →  /usr/bin, /usr/sbin          │
│  Kernel      →  /boot                        │
│  Devices     →  /dev                         │
│  System info →  /proc                        │
│  Temp        →  /tmp                         │
│  State       →  /var/lib                     │
│                                              │
└──────────────────────────────────────────────┘

Visual: Backup Priority

┌──────────────────────────────────────────────┐
│  Critical                                    │
│  ── /home          user data                 │
│  ── /etc           configuration             │
│  ── /var/lib       application state         │
│                                              │
│  Useful                                      │
│  ── /root/.ssh     admin keys                │
│  ── /var/log       recent logs (usually not) │
│  ── /usr/local     local installs            │
│                                              │
│  Not needed                                  │
│  ── /tmp, /var/tmp temporary                 │
│  ── /proc, /sys    virtual                   │
│  ── /usr/bin       reinstalled via packages  │
│                                              │
└──────────────────────────────────────────────┘

---

Summary

Directory	What’s Inside	Key Files
/etc	Configuration	passwd, fstab, hosts, sshd_config
/var/log	Logs	syslog, auth.log, kern.log
/home	User data	.bashrc, .ssh/, Documents/
/root	Root’s home	.bashrc, .ssh/
/usr/bin	User binaries	ls, cat, grep
/usr/sbin	System binaries	fdisk, mount
/proc	Process/kernel info	cpuinfo, meminfo, loadavg
/dev	Devices	sda, null, urandom, tty
/boot	Kernel/bootloader	vmlinuz-*, grub/
/tmp	Temporary files	cleared on reboot
/var/lib	Application state	dpkg/, mysql/, docker/

Key takeaways:

• /etc holds configuration — the most important directory to back up
• /var/log holds logs — first place to look when troubleshooting
• /home holds user data; /root is root’s home
• /usr/bin and /usr/sbin hold most executables — $PATH finds them
• /proc is virtual — process and kernel info exposed as files
• /dev is virtual — devices as files (/dev/null, /dev/sda, /dev/urandom)
• /boot holds the kernel and bootloader — critical but small
• /tmp is for scratch files, cleared on reboot — use mktemp
• /var/lib holds application state — databases, package DBs, container data
• /etc/passwd, /etc/fstab, /etc/hosts, /etc/resolv.conf are the configs you’ll read and edit most
• Never edit /etc/passwd, /etc/sudoers, or grub.cfg directly — use the proper tools
• Back up /etc, /home, and /var/lib — those hold what you can’t easily recreate

Remember: These ten directories cover almost everything a sysadmin touches. Configs in /etc, logs in /var/log, user data in /home, programs in /usr, kernel info in /proc, devices in /dev, the kernel in /boot, temp files in /tmp, state in /var/lib, and root’s home at /root. Knowing what’s in each — and which files matter — makes you effective on any Linux system, no matter the distribution.

---

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!