Chapter 2: Linux Filesystem & Essential Commands

20 min read ▅▅ Beginner Updated July 2026

Linux Filesystem Tree Structure

/
├── bin/ Essential user command binaries
├── boot/ Boot loader files, kernels
├── dev/ Device files
├── etc/ System configuration files
├── home/ User home directories
├── lib/ Essential shared libraries
├── media/ Mount points for removable media
├── mnt/ Temporary mount points
├── opt/ Optional software packages
├── proc/ Virtual filesystem for process info
├── root/ Home directory for root user
├── run/ Runtime variable data
├── sbin/ System administration binaries
├── srv/ Data for services
├── sys/ Virtual filesystem for kernel objects
├── tmp/ Temporary files
├── usr/ User utilities and applications
└── var/ Variable data files (logs, spool, cache)
    └── log/ System log files
              

Learning Objectives

  • Understand the Linux filesystem hierarchy.
  • Navigate efficiently using absolute and relative paths.
  • Learn the purpose of important system directories.
  • Master navigation with pwd and cd.
  • Create, copy, move, and remove files and directories safely.
  • View, search, link, and check disk usage with everyday admin commands.

Prerequisites

You should have completed Chapter 1. No prior Linux experience is required beyond understanding what Linux is and how to access a terminal.

1. Introduction

Every Linux administrator spends a significant amount of time navigating the filesystem. Configuration files, application data, log files, software packages and user documents are all stored within a single, well-defined directory hierarchy. Understanding this structure is one of the most valuable skills for beginners because nearly every command you learn later depends on knowing where files are located.

2. Understanding the Linux Filesystem

Unlike Windows, Linux does not organize storage using drive letters such as C: or D:. Instead, everything begins from a single top-level directory called the root directory (/). Additional disks, USB devices and network filesystems are attached somewhere under this hierarchy through a process called mounting.

                /
      ├── boot
      ├── dev
      ├── etc
      ├── home
      ├── opt
      ├── proc
      ├── root
      ├── tmp
      ├── usr
      └── var
                  
High-level Linux filesystem hierarchy.

3. Important Linux Directories

DirectoryPurposeProduction Example
/etcConfiguration filessshd_config, fstab
/varLogs & variable data/var/log
/homeUser home directories/home/admin
/rootRoot user's home/root
/usrApplications & libraries/usr/bin
/optOptional softwareOracle, IBM tools
/tmpTemporary filesInstaller files
/bootKernel & bootloadervmlinuz
/devDevice files/dev/sda
/procKernel information/proc/cpuinfo
/sysHardware interface/sys/class

4. Absolute vs Relative Paths

An absolute path always starts from /, while a relative path starts from your current working directory.

Absolute: /home/student/Documents/report.txt
Relative: Documents/report.txt
TypeStarts WithDepends on Current Location?
Absolute/No
RelativeDoes not start with / (for example ., .., or a name)Yes

5. The pwd Command

The pwd command prints the current working directory.

$ pwd
/home/student

6. The cd Command

The cd command changes your current directory.

CommandDescription
cdGo to home directory
cd /Go to root
cd ..Move one level up
cd -Return to previous directory
cd ~User home directory

7. Hands-on Practice

  1. Navigate to /var.
  2. Return to your home directory.
  3. Move to the root directory.
  4. Use cd - to return.
  5. Verify every step using pwd.

8. Listing Files with ls

The ls command displays the contents of a directory. It is one of the first commands administrators use after logging in.

OptionDescription
-lLong listing format.
-aShow hidden files.
-hHuman-readable sizes (use with -l, as in ls -lh).
-tSort by modification time.
-RRecursive listing.

9. Creating Directories with mkdir

mkdir project
mkdir logs backup temp
mkdir -p /tmp/demo/test

The -p option creates parent directories automatically if they do not already exist.

10. Creating Files with touch

touch notes.txt
touch file1 file2 file3
touch /tmp/app.log

Besides creating empty files, touch also updates file timestamps.

11. Copying Files with cp

cp file1 file2
cp report.txt /backup/
cp -r project backup_project
OptionPurpose
-rCopy directories recursively.
-iPrompt before overwrite.
-vShow copied files.

12. Moving and Renaming Files with mv

mv old.txt new.txt
mv report.txt /archive/
mv *.log /var/log/archive/

The same command is used both for renaming files and moving them to a different directory.

13. Removing Files with rm

rm file.txt
rm -i file.txt
rm -r directory
rm -rf temp_directory

14. Redirection and Pipes

Shell redirection sends command output to files or other commands instead of the terminal.

OperatorMeaning
>Redirect stdout to a file (overwrite).
>>Append stdout to a file.
2>Redirect stderr to a file.
2>&1Send stderr to the same place as stdout.
|Pipe stdout into another command.

The tee command is not a redirection operator. It reads stdin and writes it both to a file and to stdout, which is useful when you want a saved copy and still want to see the output:

ls -l > listing.txt
echo "error" >> app.log
grep ERROR /var/log/syslog 2> errors.txt
df -h | tee disk-report.txt

15. Viewing Files with cat, less, and tail

cat displays the contents of text files. Large log files should be viewed with less because it loads data page by page.

CommandPurpose
headFirst 10 lines by default.
tailLast 10 lines by default.
tail -fMonitor a growing log file in real time.

16. Searching via find and locate

The find command searches directories based on name, type, size, and modifications.

find /etc -name sshd_config
find . -name "*.log"

The locate command searches a prebuilt filename database. On many distributions the database tools come from plocate or the older mlocate package (whichever your distro ships). Update the database with updatedb before relying on locate results.

sudo updatedb
locate sshd_config

18. Inspecting Files with stat and file

The stat command displays detailed metadata including permissions, inode, timestamps and ownership. The file command determines the actual file type instead of relying on the filename extension.

$ stat /etc/hostname
  File: /etc/hostname
  Size: 12        	Blocks: 8          IO Block: 4096   regular file
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

$ file /bin/ls
/bin/ls: ELF 64-bit LSB pie executable, x86-64, ...

19. Disk Usage Commands (df, du)

Use df -h to check free and used space on mounted filesystems. Use du -sh to determine which directories consume the most storage.

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   32G   16G  67% /

$ du -sh /var/log
248M	/var/log

$ du -sh /var/log/* | sort -h | tail -5
 12M	/var/log/journal
 80M	/var/log/syslog

Commands Covered in This Chapter

  • pwd - Print working directory
  • cd - Change directory
  • ls - List directory contents
  • touch - Create empty file or update timestamp
  • mkdir - Create directories
  • cp - Copy files and directories
  • mv - Move/rename files and directories
  • rm - Remove files and directories
  • tee - Write stdin to a file and to stdout
  • cat - Concatenate and display files
  • less - View file contents page by page
  • head - Display first lines of file
  • tail - Display last lines of file
  • find - Search for files in directory hierarchy
  • locate / updatedb - Search a filename database (plocate or mlocate)
  • ln - Create hard and symbolic links
  • stat - Display file metadata
  • file - Determine file type
  • du - Estimate file space usage
  • df - Report filesystem disk space usage

Real Production Scenario: Locating Log Files

Scenario: Your web application is throwing 500 errors. You need to find recent error logs.

Log locations differ by distribution and service. Traditional syslog-style messages often appear in /var/log/syslog (Debian/Ubuntu) or /var/log/messages (many RHEL-family systems); on systemd hosts, journalctl is the primary interface. Apache logs are commonly under /var/log/apache2/ on Debian/Ubuntu and /var/log/httpd/ on RHEL-family systems.

cd /var/log
ls -lht | head
# Debian/Ubuntu Apache example:
tail -n 50 /var/log/apache2/error.log
# RHEL-family Apache (httpd) example:
# tail -n 50 /var/log/httpd/error_log
# Recent systemd journal entries:
# journalctl -u apache2 -n 50   # or -u httpd
find /var/log -type f -mtime -1 -name "*.log"
              

This workflow is used daily by production SREs and sysadmins to troubleshoot live issues.