The Linux file system is one of the first things a new sysadmin must understand. Unlike Windows, Linux organizes everything under a single root directory — /. Every file, device, and process lives somewhere under this tree. Knowing the layout helps you find config files quickly, debug issues faster, and understand what the OS is doing under the hood.
The Root Directory and the FHS
Linux follows the Filesystem Hierarchy Standard (FHS), which defines where different types of files should live. This makes Linux distributions predictable — whether you are on Ubuntu, CentOS, or Arch, the core structure is the same.
Everything starts at /, the root. From there, subdirectories branch out, each with a defined purpose.
Key Directories Explained
/etc — System Configuration
This is where almost all system-wide configuration files live. If you want to configure networking, user accounts, services, or software behavior, you will find the relevant files here.
ls /etc/
cat /etc/hostname
cat /etc/hosts
cat /etc/fstabImportant files inside /etc:
- /etc/passwd — user account info (username, UID, home dir, shell)
- /etc/shadow — hashed passwords (root-only access)
- /etc/fstab — filesystem mount table
- /etc/ssh/sshd_config — SSH server configuration
- /etc/crontab — system-level cron jobs
/var — Variable Data
Files that change frequently at runtime are stored under /var. Logs, mail spools, databases, and package manager caches all live here.
ls /var/log/
tail -f /var/log/syslog
du -sh /var/cache/apt/- /var/log — system and application logs
- /var/lib — persistent application state (e.g., databases)
- /var/cache — cached data from package managers
- /var/spool — queued jobs (print, mail, cron)
/home — User Home Directories
Each regular user gets a subdirectory under /home. This is where personal files, shell config files (.bashrc, .profile), and user-specific application configs are stored.
ls /home/
ls -la /home/alok/Root home is separate — it lives at /root, not /home/root.
/proc — Virtual Process Filesystem
/proc is a virtual filesystem that the kernel creates in memory. It exposes information about running processes and kernel internals as readable files.
cat /proc/cpuinfo # CPU details
cat /proc/meminfo # Memory stats
cat /proc/uptime # System uptime in seconds
ls /proc/1/ # Info about PID 1 (systemd)Files in /proc do not exist on disk — they are generated live by the kernel each time you read them.
/sys — Kernel and Hardware Interface
Similar to /proc, /sys is a virtual filesystem (sysfs) that exposes kernel objects like devices and drivers.
cat /sys/class/net/eth0/speed # NIC speed
ls /sys/block/ # Block devices/dev — Device Files
Linux represents hardware devices as files under /dev. This is a core Unix philosophy — everything is a file.
- /dev/sda — first SATA/SCSI hard disk
- /dev/null — discard all data written to it
- /dev/zero — stream of zero bytes
- /dev/random — random data source
- /dev/tty — current terminal
ls /dev/sd*
echo "test" > /dev/null/bin, /sbin, /usr/bin, /usr/sbin — Executables
These directories hold the system binaries (commands you run in the shell).
- /bin — essential user binaries (ls, cp, mv, bash)
- /sbin — essential system binaries (fdisk, iptables, reboot)
- /usr/bin — most user-installed programs
- /usr/sbin — non-essential system admin tools
On modern systems (Ubuntu 20.04+, Fedora), /bin is a symlink to /usr/bin — this is called the UsrMerge.
/tmp — Temporary Files
Programs store temporary files here. The contents are cleared on reboot and sometimes periodically by systemd-tmpfiles.
ls /tmp/
df -h /tmp/boot — Boot Files
Kernel images, initramfs files, and the GRUB bootloader config live here.
ls /boot/
ls /boot/grub//opt and /usr/local — Third-Party Software
Software installed manually (outside the package manager) typically goes into /opt or /usr/local. This keeps it separate from OS-managed packages.
Checking Disk Usage by Directory
du -sh /* # Size of each top-level directory
du -sh /var/log/* # Size breakdown inside /var/log
df -h # Filesystem usage summaryFinding Files Across the Tree
find /etc -name "*.conf" # All .conf files under /etc
find /var/log -mtime -1 # Log files modified in last 24h
locate nginx.conf # Fast search using mlocate databaseSummary
Understanding the Linux file system hierarchy is foundational. When a service fails, you check /etc for config and /var/log for errors. When disk space runs out, you look at /var and /home. When you need to understand system state, you read /proc. Everything has a place, and once you know the layout, navigating any Linux system becomes second nature.