LFCA 9 🐧 The Linux Filesystem Hierarchy

Linux organizes every file into a single tree — one root, many branches, no drive letters. The Filesystem Hierarchy Standard (FHS) defines what lives where: /etc for configuration, /home for user data, /var for variable data, /usr for programs, /tmp for temporary files. Every Linux distribution follows this standard, so once you know the layout, you can navigate any system. The LFCA exam expects you to know the major directories, what each is for, and how they differ from Windows-style drive letters.

Key point: Linux has one filesystem tree rooted at /. Everything — including additional disks — is mounted somewhere under that tree. There are no drive letters like C: or D:. The FHS defines the standard directories and their purposes. Knowing where to look for what — configuration, logs, binaries, user data — is the foundation of every Linux task.

---

The single tree

In Linux, every file and directory lives under / — the root directory. That’s different from Windows, where each drive has its own letter.

Windows vs Linux:

Windows	Linux
C:\	/
C:\Users\Alice	/home/alice
C:\Windows\System32	/usr/bin, /usr/lib
D:\ (second drive)	Mounted at /mnt/data or similar
E:\ (USB)	Mounted at /media/user/USB

How additional disks work:

A second physical disk doesn’t get a new letter. Instead, it’s mounted at a directory in the tree.

# Mount a disk at /mnt/data
sudo mount /dev/sdb1 /mnt/data

# Now /mnt/data is the disk
ls /mnt/data

The disk’s contents appear at /mnt/data. The rest of the tree is unaffected.

Why this design: Everything is a path. A program reads /etc/config, writes /var/log/output, stores user data in /home/alice, regardless of which physical disk holds it. Mounting is transparent — paths just work.

Mounting at boot: The /etc/fstab file lists what to mount and where. Each line: device, mount point, filesystem type, options.

/dev/sdb1   /mnt/data   ext4   defaults   0 2

At boot, the kernel reads this and mounts everything automatically.

Why “everything is a file”: In Linux, devices, sockets, pipes, and regular files all appear in the filesystem. /dev/sda is the first disk. /proc/cpuinfo shows CPU info. This uniform interface is one of Linux’s foundational ideas — programs interact with hardware and system state through the same read/write model as regular files.

---

The FHS — purpose of each directory

The Filesystem Hierarchy Standard defines each top-level directory’s purpose. Every distribution follows it.

Directory	Purpose
/	Root of the tree
/bin	Essential user binaries (commands)
/sbin	System binaries (admin commands)
/etc	System configuration files
/home	User home directories
/root	Root user’s home
/var	Variable data (logs, spools, caches)
/tmp	Temporary files
/usr	User-installed programs and libraries
/opt	Optional add-on software
/lib	Shared libraries for binaries
/boot	Kernel and bootloader files
/dev	Device files
/proc	Kernel and process info (virtual)
/sys	Kernel and hardware info (virtual)
/mnt	Temporary mount point for admins
/media	Removable media mount point
/srv	Service data (web, ftp, etc.)
/run	Runtime data (since boot)

These aren’t arbitrary. Each has a specific role. /etc for config, /var for data that changes, /usr for user-space programs, /dev for devices. Once you know the pattern, you know where to find almost anything.

Why the standard matters: A sysadmin on any distro knows where to look. Web server configs are in /etc/nginx or /etc/apache2. Logs are in /var/log. User files are in /home. The path is predictable, so skills transfer between systems.

Modern merges: On many distros, /bin, /sbin, and /lib are symlinks into /usr/bin, /usr/sbin, and /usr/lib. This is called usr-merge — it simplifies the layout without changing the standard paths.

ls -l /bin
# lrwxrwxrwx 1 root root 7 ... /bin -> usr/bin

Either path works. The FHS still documents both.

Why the FHS exists: Early Unix systems organized files differently. The FHS standardized the layout so software could rely on paths. A package’s config goes in /etc, its logs in /var/log, its binary in /usr/bin. Without the standard, every distro would invent its own layout, and no software would be portable.

---

/ — the root

The root directory is the top of the tree. Everything else is below it.

ls /
# bin  boot  dev  etc  home  lib  media  mnt
# opt  proc  root  run  sbin  srv  sys  tmp  usr  var

Every other directory is a child of /. Paths can be absolute (starting with /) or relative (starting from the current directory).

Absolute paths:

cd /etc/nginx
cat /var/log/syslog
ls /home/alice/Documents

Start with / — always from the root.

Relative paths:

cd nginx              # from current dir
cat ../config
./script.sh

No leading / — relative to where you are.

Special path symbols:

Symbol	Meaning
/	Root
.	Current directory
..	Parent directory
~	Home directory
~alice	Alice’s home

Why the root is unique: It can’t be renamed, moved, or removed. Everything depends on it. If / is corrupted, the system won’t boot.

Why absolute vs relative matters: Absolute paths work from anywhere; relative paths depend on where you are. Scripts use absolute paths for predictability. Interactive shells often use relative paths for brevity.

---

/bin and /sbin — essential binaries

/bin holds essential user commands; /sbin holds system administration commands.

/bin examples:

• ls, cp, mv, rm
• cat, grep, sed, awk
• bash, sh
• mkdir, rmdir, touch

/sbin examples:

• fdisk, mkfs, fsck
• iptables, ip
• reboot, shutdown
• mount, umount

What “essential” means: Available even when the system is booting or in recovery mode, before /usr is mounted. Modern distros with usr-merge often have /bin and /sbin as symlinks to /usr/bin and /usr/sbin, but the paths still work.

Modern conventions:

• User commands → /usr/bin
• System commands → /usr/sbin
• Local administrator commands → /usr/local/bin or /usr/local/sbin

Why the split: Historically, /bin was for everyone; /sbin was for root. In practice, non-root users can run many /sbin commands if they have permission. The split is about purpose more than access control now.

Why the distinction: A normal user needs ls and cp. A sysadmin needs fdisk and mkfs. Keeping admin tools in /sbin signals “these require root or advanced knowledge.” Both are in the $PATH for root, so commands work either way.

---

/etc — configuration

/etc holds system-wide configuration files. Everything that configures software lives here — usually as plain text.

Common files:

Path	Purpose
/etc/passwd	User accounts
/etc/shadow	Password hashes (root only)
/etc/group	Groups
/etc/hosts	Local hostname resolution
/etc/resolv.conf	DNS servers
/etc/fstab	Filesystem mounts at boot
/etc/ssh/sshd_config	SSH server config
/etc/nginx/nginx.conf	Nginx config
/etc/apt/	APT package manager config
/etc/netplan/	Network config (Ubuntu)
/etc/systemd/	systemd config

Conventions:

• Text files. Editable with any editor.
• Comments start with #.
• Subdirectories group related configs (/etc/nginx/, /etc/ssh/).
• .d directories hold drop-in config fragments (/etc/apt/apt.conf.d/).
• .conf files are usually the main config.

Common pattern:

/etc/program/
├── program.conf         ← main config
├── conf.d/              ← drop-ins
│   ├── 10-base.conf
│   └── 20-custom.conf
└── snippets/            ← reusable parts

The .d convention lets packages drop config files without editing the main config.

Backups: /etc is the most important directory to back up. It contains everything that makes the system this specific system — users, network, services, apps. Copying /etc to another machine reproduces the configuration.

Why /etc is critical: Configuration defines behavior. A broken config file can prevent a service from starting, lock out users, or make the network unreachable. /etc is where admins spend most of their time.

Why “etc” for config: The name stands for “et cetera” — it was originally a catch-all directory for things that didn’t belong elsewhere. Over time, it became the standard place for configuration. Modern usage is unambiguous: system config goes in /etc.

---

/home and /root — user directories

Home directories hold each user’s personal files, settings, and documents.

User home directories:

/home/alice/
├── Documents/
├── Downloads/
├── Pictures/
├── .bashrc              ← shell config
├── .config/             ← app configs
└── .ssh/                ← SSH keys

Each user gets their own /home/USERNAME directory, created when the account is added. It’s their space — files, preferences, SSH keys, and application data.

Dot files: Hidden files starting with . hold user-specific config. .bashrc, .zshrc, .gitconfig, .vimrc. They’re user-level equivalents of /etc — config for that user’s tools.

Root’s home: The root user’s home is /root, not /home/root. This is deliberate — root’s home is available even if /home isn’t mounted.

sudo ls /root
# contents of root's home

Permissions: Each user owns their own /home/USERNAME and can’t access others’ by default.

ls -l /home
# drwxr-xr-x 2 alice alice 4096 ... alice
# drwxr-xr-x 2 bob   bob   4096 ... bob

Only the user (and root) can read/write inside.

Why home directories matter: They’re where user data lives. Backups, migrations, and account management all focus on /home. Losing /home is losing user data; losing everything else is a reinstall.

Why /root isn’t under /home: Root’s home needs to be available even when /home is on a separate partition that isn’t mounted, or during recovery when /home might be corrupted. Keeping it at /root guarantees root can always log in with their config.

---

/var — variable data

/var holds data that changes while the system runs — logs, caches, spools, databases.

Common subdirectories:

Path	Purpose
/var/log/	System and application logs
/var/cache/	Application caches
/var/spool/	Print, mail, cron queues
/var/tmp/	Temporary files that survive reboot
/var/lib/	State data (databases, package info)
/var/www/	Web content (some setups)
/var/run/ → /run	Runtime data (symlink on modern systems)

Key files:

/var/log/syslog            ← general system log
/var/log/auth.log          ← authentication events
/var/log/kern.log          ← kernel messages
/var/log/dpkg.log          ← package operations
/var/log/nginx/            ← web server logs
/var/lib/mysql/            ← MySQL data
/var/lib/docker/           ← Docker data

Why /var is separate: Logs grow. Caches fill disks. Spools accumulate. Keeping /var on its own partition prevents these from filling / and crashing the system. On servers, /var often has its own volume.

Managing /var:

# Check size
du -sh /var/log

# Rotate logs (via logrotate)
sudo logrotate -f /etc/logrotate.conf

# Clean cache
sudo apt clean

Why the exam tests /var: It’s where logs live. Knowing /var/log is the first step in troubleshooting any issue. Services log here by convention.

Why variable data has its own directory: Data that grows or changes shouldn’t share a partition with static system files. If /var/log fills up, you don’t want / to fill with it. The separation is a safety mechanism — /var fills, the rest of the system keeps running.

---

/usr — user programs and libraries

/usr holds user-space programs, libraries, documentation, and shared data. It’s usually the largest directory after /home.

Common subdirectories:

Path	Purpose
/usr/bin/	Most user commands
/usr/sbin/	System commands
/usr/lib/	Libraries
/usr/share/	Architecture-independent data (docs, icons)
/usr/local/	Locally installed software
/usr/include/	C headers
/usr/src/	Source code (kernels)

What’s in /usr/share/:

• Documentation — man pages, doc
• Icons, fonts
• Locale files
• Application data that doesn’t depend on architecture

What’s in /usr/local/:

Software you install manually (not via the package manager) goes here:

/usr/local/bin/
/usr/local/lib/
/usr/local/etc/
/usr/local/share/

This keeps locally compiled tools separate from package-managed ones.

The /usr merge: On modern systems, /bin, /sbin, and /lib are symlinks into /usr. This unification simplifies the layout — everything user-space lives under /usr.

ls -l /bin /sbin /lib
# /bin -> usr/bin
# /sbin -> usr/sbin
# /lib -> usr/lib

Why /usr matters: Most installed software lives here. When you install a package with apt or dnf, its files land in /usr/bin, /usr/lib, /usr/share. Understanding /usr means knowing where software goes.

Why /usr/local is special: Package managers own /usr/bin, /usr/lib, etc. Installing files there manually can conflict with packages. /usr/local is reserved for the admin — the package manager doesn’t touch it. Manual installs go there to avoid conflicts.

---

/boot — kernel and bootloader

/boot holds everything needed to boot the system.

Contents:

File/Dir	Purpose
vmlinuz-*	The kernel
initrd.img-* / initramfs-*	Initial RAM filesystem
grub/	GRUB bootloader config
System.map-*	Kernel symbol table
config-*	Kernel build config

Example:

/boot/
├── vmlinuz-6.8.0-45-generic
├── initrd.img-6.8.0-45-generic
├── config-6.8.0-45-generic
├── System.map-6.8.0-45-generic
└── grub/
    └── grub.cfg

On UEFI systems, the EFI System Partition is usually mounted at /boot/efi, containing bootloaders and firmware files.

Updating the kernel: Package managers install new kernels here. GRUB is regenerated to include them in the menu. Old kernels accumulate until cleaned up.

# List installed kernels
dpkg -l | grep linux-image

# Remove old kernels
sudo apt autoremove

Why /boot can be small but critical: Kernels and initramfs files are 10–100 MB each. A 500 MB /boot partition is common. Filling it prevents kernel updates.

Why /boot is a separate partition: Older systems couldn’t read large disks from the bootloader, so /boot had to be within the first few GB. That limitation is gone, but the separation persists — it protects boot files from filling up with user data, and on encrypted systems, /boot stays unencrypted so the bootloader can read it.

---

Virtual filesystems — /proc, /sys, /dev, /run

These aren’t real files on disk. They’re virtual — the kernel exposes information and device access through them.

/proc — process and kernel info:

cat /proc/cpuinfo       # CPU information
cat /proc/meminfo       # Memory info
cat /proc/version       # Kernel version
ls /proc/               # numeric dirs = process IDs
cat /proc/1234/cmdline  # command line of PID 1234

Each running process gets a /proc/PID directory.

/sys — hardware and kernel objects:

ls /sys/class/net/      # network interfaces
cat /sys/class/thermal/thermal_zone0/temp   # temperature

/sys exposes the kernel’s device model as a tree. Used by tools and for tweaking hardware parameters.

/dev — device files:

ls /dev/sd*             # disks
ls /dev/tty*            # terminals
ls /dev/null            # null device

Devices appear as files. Writing to /dev/sda writes to the disk. Reading from /dev/urandom gives random bytes.

/run — runtime data since boot:

ls /run/                # PID files, sockets, locks
cat /run/sshd.pid       # PID of sshd

/run is a tmpfs — stored in memory, wiped on reboot. For runtime state that shouldn’t persist.

Why virtual filesystems matter: They give uniform access to system state. A program can read hardware info from /sys, process info from /proc, and devices from /dev, all through the same file interface. No special APIs needed — just read and write.

Why they look like directories: Linux treats them uniformly. The kernel implements them as filesystems — procfs, sysfs, devtmpfs — mounted at boot. To the shell, they behave like regular directories. To the kernel, they’re dynamic views of system state.

---

/tmp, /mnt, /media, /opt, /srv

Five more directories worth knowing.

/tmp — temporary files:

mktemp              # create a temp file
echo "data" > /tmp/scratch

Files here are typically cleared on reboot (systemd-tmpfiles or tmpwatch). All users can write here. Don’t store anything you need to keep.

/mnt — temporary mounts:

Admin-mounted filesystems. Used for temporarily mounting a disk or network share:

sudo mount /dev/sdb1 /mnt

Administrator’s scratch space for mounts.

/media — removable media:

Auto-mounted USB drives, DVDs, external disks. The desktop environment mounts them here:

/media/alice/USB_DRIVE/
/media/alice/CD-ROM/

/opt — optional software:

Third-party applications installed as a self-contained package:

/opt/google/chrome/
/opt/spotify/

Each app gets its own subdirectory. Used by software that doesn’t fit the FHS layout of /usr.

/srv — service data:

Data served by the system — web roots, FTP directories, git repos. Often unused on modern systems, but historically:

/srv/www/
/srv/ftp/
/srv/git/

Web content often lives in /var/www instead, but /srv is the FHS-correct place.

Why these exist: Each handles a specific kind of ephemeral, external, or service-specific data. /tmp for scratch, /mnt for admin mounts, /media for users, /opt for third-party apps, /srv for service data.

Why /tmp is world-writable: Every process might need a scratch file. Restricting it to root would break many tools. The convention is that /tmp is shared, cleaned at boot, and never trusted for anything important. Symlink attacks are why /tmp is often mounted with noexec or nosuid.

---

A full example

Exploring the filesystem hierarchy on a real system.

# ============================================
# PART 1: TOP-LEVEL STRUCTURE
# ============================================

ls -F /
# [ bin@  boot/  dev/  etc/  home/  lib@  media/  mnt/ ]
# [ opt/  proc/  root/  run/  sbin@  srv/  sys/  tmp/  usr/  var/ ]

# ============================================
# PART 2: /etc — CONFIGURATION
# ============================================

ls /etc | head -10
# [ adduser.conf  alternatives  apt  bash.bashrc  ... ]

cat /etc/hostname
# [ myserver ]

cat /etc/hosts
# [ 127.0.0.1    localhost ]
# [ 127.0.1.1    myserver ]

# ============================================
# PART 3: /home — USER DATA
# ============================================

ls /home
# [ alice ]

ls -la /home/alice | head -5
# [ drwxr-xr-x  ... . ]
# [ drwxr-xr-x  ... .. ]
# [ -rw-r--r--  ... .bashrc ]
# [ drwx------  ... .ssh ]

# ============================================
# PART 4: /var — VARIABLE DATA
# ============================================

ls /var/log | head -8
# [ apt  auth.log  boot.log  dpkg.log  journal  kern.log  syslog  ... ]

sudo tail -3 /var/log/syslog
# [ recent log entries ]

# ============================================
# PART 5: /usr — PROGRAMS
# ============================================

ls /usr/bin | head -5
# [ a2ps  a2p  aa-enabled  aa-exec  ab ]

which ls cat grep
# [ /usr/bin/ls ]
# [ /usr/bin/cat ]
# [ /usr/bin/grep ]

# ============================================
# PART 6: /boot — KERNEL
# ============================================

ls /boot
# [ config-6.8.0-45-generic ]
# [ grub/ ]
# [ initrd.img-6.8.0-45-generic ]
# [ System.map-6.8.0-45-generic ]
# [ vmlinuz-6.8.0-45-generic ]

# ============================================
# PART 7: VIRTUAL FILESYSTEMS
# ============================================

cat /proc/version
# [ Linux version 6.8.0-45-generic ... ]

ls /sys/class/net/
# [ enp3s0  lo ]

ls /dev/sd* /dev/null
# [ /dev/sda  /dev/sda1  /dev/sda2  /dev/null ]

ls /run | head -5
# [ NetworkManager  cloud-init  lock  sshd.pid  ... ]

# ============================================
# PART 8: SPECIAL DIRECTORIES
# ============================================

ls /tmp | head -3
# [ snap-private-tmp  systemd-private-... ]

ls /opt
# [ google ]

ls /srv
# [ (empty or service data) ]

# ============================================
# PART 9: DISK USAGE BY DIRECTORY
# ============================================

sudo du -sh /* 2>/dev/null | sort -h
# [ 4.0K   /srv ]
# [ 16K    /opt ]
# [ 1.2M   /root ]
# [ 5.8M   /tmp ]
# [ 10M    /media ]
# [ 100M   /boot ]
# [ 500M   /home ]
# [ 1.5G   /var ]
# [ 5.0G   /usr ]
# [ 7.5G   / (total) ]

The exploration covers each major directory — what’s in it, what it looks like, what its purpose is.

Why this exercise is the fastest way to learn: Seeing the real directories — with real contents — makes the FHS concrete. You see /etc/hostname, /home/alice/.bashrc, /var/log/syslog. The abstract layout becomes a working system.

---

Complete Example Session

# ============================================
# PART 1: EXPLORE THE ROOT
# ============================================

ls -F /
# [ bin@  boot/  dev/  etc/  home/  lib@  media/ ]
# [ mnt/  opt/  proc/  root/  run/  sbin@  srv/ ]
# [ sys/  tmp/  usr/  var/ ]

# ============================================
# PART 2: /bin, /sbin, /usr/bin
# ============================================

ls -l /bin
# [ lrwxrwxrwx ... /bin -> usr/bin ]

which ls cp mv
# [ /usr/bin/ls ]
# [ /usr/bin/cp ]
# [ /usr/bin/mv ]

which fdisk reboot
# [ /usr/sbin/fdisk ]
# [ /usr/sbin/reboot ]

# ============================================
# PART 3: /etc CONTENTS
# ============================================

ls /etc/ | wc -l
# [ 220 ]

ls /etc/ | grep -E 'passwd|group|hosts|fstab|resolv'
# [ fstab ]
# [ group ]
# [ hosts ]
# [ passwd ]
# [ resolv.conf ]

head -3 /etc/passwd
# [ root:x:0:0:root:/root:/bin/bash ]
# [ daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin ]
# [ bin:x:2:2:bin:/bin:/usr/sbin/nologin ]

# ============================================
# PART 4: /home CONTENTS
# ============================================

ls -a /home/alice | head -10
# [ .  ..  .bash_history  .bash_logout  .bashrc ]
# [ .cache  .config  .local  .profile  .ssh ]

# ============================================
# PART 5: /var LOGS
# ============================================

ls -la /var/log/ | head -10
# [ drwxrwxr-x  ... apt/ ]
# [ -rw-r-----  ... auth.log ]
# [ -rw-r-----  ... kern.log ]
# [ -rw-r-----  ... syslog ]

sudo tail -1 /var/log/syslog
# [ (recent kernel or service message) ]

# ============================================
# PART 6: /usr STRUCTURE
# ============================================

ls /usr
# [ bin  games  include  lib  libexec  local  sbin  share  src ]

ls /usr/local
# [ bin  etc  games  include  lib  man  sbin  share  src ]

ls /usr/share | head -5
# [ applications  bash-completion  ca-certificates ]
# [ dict  doc  fonts  ... ]

# ============================================
# PART 7: /boot CONTENTS
# ============================================

ls /boot/
# [ config-6.8.0-45-generic ]
# [ grub/ ]
# [ initrd.img-6.8.0-45-generic ]
# [ System.map-6.8.0-45-generic ]
# [ vmlinuz-6.8.0-45-generic ]

ls /boot/grub/
# [ fonts  gfxblacklist.txt  grub.cfg  grubenv ]
# [ i386-pc  locale  unicode.pf2  x86_64-efi ]

# ============================================
# PART 8: VIRTUAL FILESYSTEMS
# ============================================

cat /proc/cpuinfo | grep "model name" | head -1
# [ model name: AMD Ryzen 5 5600X ... ]

ls /proc/ | grep '^[0-9]' | head -3
# [ 1  ]
# [ 10 ]
# [ 100 ]

ls /sys/class/net/
# [ enp3s0  lo ]

ls /sys/class/thermal/
# [ cooling_device0  thermal_zone0  ... ]

ls /dev/sd* /dev/tty* 2>/dev/null | head -5
# [ /dev/sda ]
# [ /dev/sda1 ]
# [ /dev/sda2 ]
# [ /dev/tty ]
# [ /dev/tty0 ]

ls /run/ | head -5
# [ NetworkManager ]
# [ cloud-init ]
# [ lock ]
# [ sshd.pid ]
# [ systemd ]

# ============================================
# PART 9: OTHER DIRECTORIES
# ============================================

ls /tmp | head -3
# [ snap-private-tmp ]
# [ systemd-private-abc ]

ls /opt/
# [ google ]
# [ (empty or vendor dirs) ]

ls /srv/
# [ (usually empty) ]

ls /mnt /media
# [ /mnt: (empty) ]
# [ /media: alice ]

# ============================================
# PART 10: DISK USAGE
# ============================================

sudo du -sh /* 2>/dev/null | sort -h | tail -8
# [ 100K   /root ]
# [ 200K   /opt ]
# [ 1.2M   /run ]
# [ 5.8M   /tmp ]
# [ 100M   /boot ]
# [ 500M   /home ]
# [ 1.5G   /var ]
# [ 5.0G   /usr ]

# ============================================
# PART 11: MOUNTS
# ============================================

mount | grep -E '^/dev' | head -5
# [ /dev/sda2 on / type ext4 (rw,relatime) ]
# [ /dev/sda1 on /boot/efi type vfat (rw,relatime) ]
# [ /dev/sdb1 on /mnt/data type ext4 (rw,relatime) ]

cat /etc/fstab
# [ UUID=...  /         ext4  defaults   0 1 ]
# [ UUID=...  /boot/efi vfat  umask=0077 0 1 ]
# [ /dev/sdb1  /mnt/data ext4 defaults   0 2 ]

The session covers the whole tree — root, /etc, /home, /var, /usr, /boot, virtual filesystems, special directories, disk usage, mounts, fstab.

Why this exercise: It’s the workflow a new admin runs to learn a system — explore, read configs, check logs, find binaries, look at disk usage. The FHS becomes second nature once you’ve walked it on a real machine.

---

Quick Reference

Top-Level Directories

Directory	Purpose
/	Root of tree
/bin	Essential user binaries
/sbin	System binaries
/lib	Shared libraries
/etc	Configuration
/home	User home directories
/root	Root’s home
/var	Variable data (logs, caches)
/tmp	Temporary files
/usr	User programs
/opt	Optional add-on software
/boot	Kernel and bootloader
/dev	Device files
/proc	Process and kernel info
/sys	Hardware and kernel objects
/mnt	Temporary mount point
/media	Removable media
/srv	Service data
/run	Runtime data

Where to Find What

Need	Location
System config	/etc
User files	/home/USER
Logs	/var/log
Databases	/var/lib
Caches	/var/cache
User commands	/usr/bin
System commands	/usr/sbin
Libraries	/usr/lib
Docs	/usr/share/doc
Locally installed	/usr/local
Kernel	/boot
Third-party apps	/opt

Common Config Files

File	Purpose
/etc/passwd	Users
/etc/shadow	Password hashes
/etc/group	Groups
/etc/hosts	Static DNS
/etc/resolv.conf	DNS servers
/etc/fstab	Mounts at boot
/etc/hostname	Hostname
/etc/sudoers	Sudo rules
/etc/ssh/sshd_config	SSH daemon

Common Log Files

File	Contains
/var/log/syslog	General log (Debian)
/var/log/messages	General log (Red Hat)
/var/log/auth.log	Authentication
/var/log/kern.log	Kernel
/var/log/dpkg.log	Package operations
/var/log/nginx/	Nginx logs
/var/log/journal/	systemd journal

Virtual Filesystems

Path	Type	Purpose
/proc	procfs	Processes, kernel info
/sys	sysfs	Hardware, kernel objects
/dev	devtmpfs	Device files
/run	tmpfs	Runtime state

Special Path Symbols

Symbol	Meaning
/	Root
.	Current dir
..	Parent dir
~	Home
~user	User’s home
-	Previous dir (cd)

/var Subdirectories

Path	Purpose
log/	Logs
cache/	Caches
lib/	State data
spool/	Queues
tmp/	Persistent temp
run/	→ /run

/usr Subdirectories

Path	Purpose
bin/	User commands
sbin/	System commands
lib/	Libraries
share/	Data, docs
local/	Local installs
include/	Headers
src/	Source code

Mount Commands

Command	Purpose
mount	List mounts
mount DEV DIR	Mount device
umount DIR	Unmount
df -h	Disk usage
lsblk	Block devices
cat /etc/fstab	Boot mounts

Disk Usage

Command	Purpose
df -h	Filesystem usage
du -sh DIR	Directory size
du -sh /*	Top-level usage

Navigation

Command	Purpose
pwd	Current directory
cd PATH	Change directory
cd ~	Home
cd -	Previous directory
ls -la	Detailed listing
tree	Tree view

Usr-Merge

Original	Symlink to
/bin	/usr/bin
/sbin	/usr/sbin
/lib	/usr/lib
/lib64	/usr/lib64

Windows vs Linux

Windows	Linux
C:\	/
C:\Users\USER	/home/USER
C:\Windows	/usr, /etc
D:\	Mounted somewhere
%TEMP%	/tmp

Common Directories by Purpose

Purpose	Directories
Programs	/usr/bin, /usr/sbin
Config	/etc
User data	/home, /root
Logs	/var/log
State	/var/lib
Cache	/var/cache
Temp	/tmp, /var/tmp
Kernel	/boot
Devices	/dev
System info	/proc, /sys

---

Best Practices

✅ Do This:

# Use absolute paths in scripts
cat /etc/hostname                                     # ✅

# Back up /etc and /home
sudo tar czf backup.tar.gz /etc /home                 # ✅

# Check /var/log when troubleshooting
sudo tail -f /var/log/syslog                          # ✅

# Read configs from /etc before changing
cat /etc/ssh/sshd_config                              # ✅

# Use /usr/local for manual installs
sudo cp mytool /usr/local/bin/                        # ✅

# Check disk usage regularly
df -h; du -sh /var/log/*                              # ✅

# Put data on a separate mount
# Mount extra disks under /mnt, /srv, or /data          # ✅

# Use /tmp for temporary files
mktemp                                                # ✅

# Clean /var/cache when low on disk
sudo apt clean                                        # ✅

# Verify after edits to /etc
# Test with -t or --check where available              # ✅

❌ Don’t Do This:

# Don't store important data in /tmp
cp important.txt /tmp/  # cleared on reboot             # ❌

# Don't edit /etc/passwd directly
sudo vim /etc/passwd  # use usermod/adduser            # ❌

# Don't install to /usr/bin manually
sudo cp mytool /usr/bin/  # packages own this         # ⚠️

# Don't fill /var with logs
# Configure logrotate                                   # ❌

# Don't delete files in /proc, /sys, /dev
rm /proc/something  # never do this                    # ❌

# Don't ignore /var/lib
# Databases live here — back them up                    # ❌

# Don't assume Windows paths
C:\Users  # that's Windows, not Linux                  # ❌

# Don't put service data in /home
# Use /srv or /var/www per convention                   # ⚠️

# Don't store user files as root
# Root's home is /root, not /home/root                  # ❌

# Don't use drive letters
# Linux has no C: or D: — everything is under /        # ❌

---

Common Pitfalls

Pitfall	Problem	Solution
Expecting drive letters	Linux uses /	Learn the tree
Storing data in /tmp	Cleared on reboot	Use /home
Editing /etc/passwd	Account corruption	Use usermod, adduser
Filling /var	Logs overflow	Configure logrotate
Forgetting /etc backup	Can’t reproduce	Back up /etc
Manual install to /usr/bin	Package conflicts	Use /usr/local/bin
Deleting /proc files	Kernel corruption	Don’t — virtual
Assuming /home/root	Doesn’t exist	Root’s home is /root
Confusing /mnt and /media	Different purposes	/mnt admin, /media auto
Ignoring /var/lib	Lose state	Back it up

---

Real-World Examples

1. Find the hostname

cat /etc/hostname

2. Find your user

grep $USER /etc/passwd

3. Read the DNS config

cat /etc/resolv.conf

4. Check mounts

cat /etc/fstab

5. List your home

ls -la ~

6. Read system logs

sudo tail -f /var/log/syslog

7. Check authentication logs

sudo tail /var/log/auth.log

8. Locate a command

which python3

9. Find all binaries of a package

dpkg -L nginx | grep bin

10. Check kernel files

ls /boot/

11. Read the kernel version

cat /proc/version

12. Check memory info

cat /proc/meminfo

13. List devices

ls /dev/sd*

14. Check network interfaces (virtual)

ls /sys/class/net/

15. List third-party apps

ls /opt/

16. Check disk usage

df -h

17. Directory sizes

sudo du -sh /* 2>/dev/null | sort -h

18. Mount a USB

sudo mount /dev/sdb1 /mnt

19. Check /usr/local

ls /usr/local/bin/

20. Find log files

ls /var/log/

---

Visual: The Filesystem Tree

┌──────────────────────────────────────────────┐
│  /                                           │
│  ├── bin/           essential user binaries  │
│  ├── boot/          kernel and bootloader    │
│  ├── dev/           device files             │
│  ├── etc/           configuration            │
│  ├── home/          user home directories    │
│  │   ├── alice/                              │
│  │   └── bob/                                │
│  ├── lib/           shared libraries         │
│  ├── media/         removable media          │
│  ├── mnt/           temporary mounts         │
│  ├── opt/           optional software        │
│  ├── proc/          process info (virtual)   │
│  ├── root/          root's home              │
│  ├── run/           runtime data             │
│  ├── sbin/          system binaries          │
│  ├── srv/           service data             │
│  ├── sys/           hardware (virtual)       │
│  ├── tmp/           temporary files          │
│  ├── usr/           user programs            │
│  │   ├── bin/                                │
│  │   ├── lib/                                │
│  │   ├── local/                              │
│  │   ├── sbin/                               │
│  │   └── share/                              │
│  └── var/           variable data            │
│      ├── cache/                              │
│      ├── lib/                                │
│      ├── log/                                │
│      └── spool/                              │
│                                              │
└──────────────────────────────────────────────┘

Visual: Where Files Go

┌──────────────────────────────────────────────┐
│  Config       →  /etc                        │
│  User data    →  /home/USER                  │
│  Logs         →  /var/log                    │
│  Binaries     →  /usr/bin, /usr/sbin         │
│  Libraries    →  /usr/lib                    │
│  Kernel       →  /boot                       │
│  Devices      →  /dev                        │
│  Temp         →  /tmp                        │
│  Third-party  →  /opt                        │
│  Service data →  /srv                        │
│  System info  →  /proc, /sys                 │
│  Runtime      →  /run                        │
│                                              │
└──────────────────────────────────────────────┘

Visual: Real Files vs Virtual

┌──────────────────────────────────────────────┐
│  Real files on disk                          │
│                                              │
│  /   /etc   /home   /usr   /var   /boot      │
│                                              │
│  Persist across reboots                      │
│  Backed up                                   │
│  Have disk space                             │
│                                              │
└──────────────────────────────────────────────┘

┌──────────────────────────────────────────────┐
│  Virtual filesystems                         │
│                                              │
│  /proc  /sys  /dev  /run                     │
│                                              │
│  Generated by kernel                         │
│  Not backed up                               │
│  Reflect system state                        │
│  Cleaned on reboot                           │
│                                              │
└──────────────────────────────────────────────┘

Visual: Mounting a Disk

┌──────────────────────────────────────────────┐
│  Before mount                                │
│                                              │
│  / (sda1)                                    │
│  ├── home/                                   │
│  ├── etc/                                    │
│  └── mnt/    ← empty                         │
│                                              │
│  sdb1  (not accessible)                      │
│                                              │
└──────────────────────────────────────────────┘
                  │
                  │  mount /dev/sdb1 /mnt
                  ▼
┌──────────────────────────────────────────────┐
│  After mount                                 │
│                                              │
│  / (sda1)                                    │
│  ├── home/                                   │
│  ├── etc/                                    │
│  └── mnt/    ← now shows sdb1's contents     │
│      ├── data/                               │
│      └── backups/                            │
│                                              │
└──────────────────────────────────────────────┘

Visual: Linux vs Windows

┌──────────────────────────────────────────────┐
│  Windows                                     │
│                                              │
│  C:\                                         │
│  ├── Users\                                  │
│  ├── Program Files\                          │
│  └── Windows\                                │
│                                              │
│  D:\  ← separate drive with letter           │
│                                              │
└──────────────────────────────────────────────┘

┌──────────────────────────────────────────────┐
│  Linux                                       │
│                                              │
│  /                                           │
│  ├── home/                                   │
│  ├── usr/                                    │
│  ├── etc/                                    │
│  └── mnt/                                    │
│      └── data/  ← second disk mounted here   │
│                                              │
│  No drive letters — one tree                 │
│                                              │
└──────────────────────────────────────────────┘

Visual: /etc Structure

┌──────────────────────────────────────────────┐
│  /etc/                                       │
│  ├── passwd                 users            │
│  ├── shadow                 passwords        │
│  ├── group                  groups           │
│  ├── hosts                  static DNS       │
│  ├── fstab                  mounts at boot   │
│  ├── hostname               machine name     │
│  ├── ssh/                   SSH config       │
│  ├── nginx/                 web server       │
│  ├── systemd/               init system      │
│  ├── apt/                   package manager  │
│  └── netplan/               network          │
│                                              │
│  Every package that needs config            │
│  puts it under /etc                          │
│                                              │
└──────────────────────────────────────────────┘

Visual: /var Layout

┌──────────────────────────────────────────────┐
│  /var/                                       │
│  ├── log/         logs                       │
│  │   ├── syslog                              │
│  │   ├── auth.log                            │
│  │   └── nginx/                              │
│  ├── cache/       caches                     │
│  │   └── apt/                                │
│  ├── lib/         state data                 │
│  │   ├── mysql/                              │
│  │   └── docker/                             │
│  ├── spool/       queues                     │
│  │   ├── cron/                               │
│  │   └── mail/                               │
│  └── tmp/         persistent temp            │
│                                              │
└──────────────────────────────────────────────┘

Visual: Disk Usage by Directory (Typical Server)

┌──────────────────────────────────────────────┐
│  /usr   ████████████████████ 5.0G            │
│  /var   ██████ 1.5G                          │
│  /home  ██ 500M                              │
│  /boot  █ 100M                               │
│  /tmp   ▏ 5.8M                               │
│  /etc   ▏ 10M                                │
│  /root  ▏ 1.2M                               │
│                                              │
└──────────────────────────────────────────────┘

Visual: Path Symbols

┌──────────────────────────────────────────────┐
│  /         absolute root                     │
│  .         current directory                 │
│  ..        parent directory                  │
│  ~         home directory                    │
│  ~alice    alice's home                      │
│  -         previous directory (cd -)         │
│                                              │
│  /etc/nginx/nginx.conf    absolute           │
│  nginx.conf               relative           │
│  ./script.sh              relative to cwd    │
│  ../config                parent dir         │
│                                              │
└──────────────────────────────────────────────┘

Visual: FHS Categories

┌──────────────────────────────────────────────┐
│  Static          Config   →  /etc            │
│  data            Binaries →  /usr/bin        │
│                  Kernel   →  /boot           │
│                                              │
│  Variable        Logs     →  /var/log        │
│  data            State    →  /var/lib        │
│                  Cache    →  /var/cache      │
│                                              │
│  Runtime         /proc, /sys, /run, /dev     │
│  (virtual)                                   │
│                                              │
│  Users           Homes    →  /home           │
│                  Root     →  /root           │
│                                              │
│  Temporary       /tmp, /var/tmp              │
│                                              │
│  External        /mnt, /media                │
│                                              │
│  Third-party     /opt, /usr/local            │
│                                              │
└──────────────────────────────────────────────┘

---

Summary

Directory	Purpose
/	Root of the filesystem tree
/bin	Essential user binaries
/sbin	System binaries
/etc	System configuration
/home	User home directories
/root	Root’s home
/var	Variable data — logs, caches, state
/tmp	Temporary files
/usr	User programs and libraries
/opt	Optional third-party software
/boot	Kernel and bootloader
/dev	Device files
/proc	Process and kernel info
/sys	Hardware and kernel objects
/mnt	Temporary mount point
/media	Removable media
/srv	Service data
/run	Runtime data

Key takeaways:

• Linux has one filesystem tree rooted at / — no drive letters
• Additional disks are mounted somewhere under the tree
• The FHS defines what lives where — every distribution follows it
• /etc holds configuration — the most important directory to back up
• /home holds user data — separate from the system
• /var holds variable data — logs, caches, state
• /usr holds programs and libraries — the bulk of installed software
• /boot holds the kernel and bootloader
• /proc, /sys, /dev, /run are virtual — generated by the kernel
• /tmp is temporary — cleared on reboot
• /mnt and /media are for external mounts
• /opt and /usr/local are for third-party and manual installs
• Path symbols — ., .., ~, - — make navigation faster
• Everything is a file — devices, processes, and hardware all appear in the tree

Remember: The Linux filesystem isn’t arbitrary. Every directory has a purpose defined by the FHS, and every distribution follows it. Once you know where things live — configs in /etc, logs in /var/log, programs in /usr, user data in /home — you can navigate any Linux system. The single tree with no drive letters is one of Linux’s most distinctive features, and the standard layout is one of its most important conventions.

---

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!