Linux Filesystem Tree Structure
/
├── bin/ Essential user command binaries
├── boot/ Boot loader files, kernels
├── dev/ Device files
├── etc/ System configuration files
├── home/ User home directories
├── lib/ Essential shared libraries
├── media/ Mount points for removable media
├── mnt/ Temporary mount points
├── opt/ Optional software packages
├── proc/ Virtual filesystem for process info
├── root/ Home directory for root user
├── run/ Runtime variable data
├── sbin/ System administration binaries
├── srv/ Data for services
├── sys/ Virtual filesystem for kernel objects
├── tmp/ Temporary files
├── usr/ User utilities and applications
└── var/ Variable data files (logs, spool, cache)
└── log/ System log files
Learning Objectives
- Understand the Linux filesystem hierarchy.
- Navigate efficiently using absolute and relative paths.
- Learn the purpose of important system directories.
- Master navigation with
pwdandcd. - Create, copy, move, and remove files and directories safely.
- View, search, link, and check disk usage with everyday admin commands.
Prerequisites
You should have completed Chapter 1. No prior Linux experience is required beyond understanding what Linux is and how to access a terminal.
1. Introduction
Every Linux administrator spends a significant amount of time navigating the filesystem. Configuration files, application data, log files, software packages and user documents are all stored within a single, well-defined directory hierarchy. Understanding this structure is one of the most valuable skills for beginners because nearly every command you learn later depends on knowing where files are located.
2. Understanding the Linux Filesystem
Unlike Windows, Linux does not organize storage using drive letters such as C: or D:. Instead, everything begins from a single top-level directory called the root directory (/). Additional disks, USB devices and network filesystems are attached somewhere under this hierarchy through a process called mounting.
/
├── boot
├── dev
├── etc
├── home
├── opt
├── proc
├── root
├── tmp
├── usr
└── var
3. Important Linux Directories
| Directory | Purpose | Production Example |
|---|---|---|
| /etc | Configuration files | sshd_config, fstab |
| /var | Logs & variable data | /var/log |
| /home | User home directories | /home/admin |
| /root | Root user's home | /root |
| /usr | Applications & libraries | /usr/bin |
| /opt | Optional software | Oracle, IBM tools |
| /tmp | Temporary files | Installer files |
| /boot | Kernel & bootloader | vmlinuz |
| /dev | Device files | /dev/sda |
| /proc | Kernel information | /proc/cpuinfo |
| /sys | Hardware interface | /sys/class |
4. Absolute vs Relative Paths
An absolute path always starts from /, while a relative path starts from your current working directory.
Absolute: /home/student/Documents/report.txt
Relative: Documents/report.txt
| Type | Starts With | Depends on Current Location? |
|---|---|---|
| Absolute | / | No |
| Relative | Does not start with / (for example ., .., or a name) | Yes |
5. The pwd Command
The pwd command prints the current working directory.
$ pwd
/home/student
6. The cd Command
The cd command changes your current directory.
| Command | Description |
|---|---|
| cd | Go to home directory |
| cd / | Go to root |
| cd .. | Move one level up |
| cd - | Return to previous directory |
| cd ~ | User home directory |
7. Hands-on Practice
- Navigate to
/var. - Return to your home directory.
- Move to the root directory.
- Use
cd -to return. - Verify every step using
pwd.
8. Listing Files with ls
The ls command displays the contents of a directory. It is one of the first commands administrators use after logging in.
| Option | Description |
|---|---|
| -l | Long listing format. |
| -a | Show hidden files. |
| -h | Human-readable sizes (use with -l, as in ls -lh). |
| -t | Sort by modification time. |
| -R | Recursive listing. |
9. Creating Directories with mkdir
mkdir project
mkdir logs backup temp
mkdir -p /tmp/demo/test
The -p option creates parent directories automatically if they do not already exist.
10. Creating Files with touch
touch notes.txt
touch file1 file2 file3
touch /tmp/app.log
Besides creating empty files, touch also updates file timestamps.
11. Copying Files with cp
cp file1 file2
cp report.txt /backup/
cp -r project backup_project
| Option | Purpose |
|---|---|
| -r | Copy directories recursively. |
| -i | Prompt before overwrite. |
| -v | Show copied files. |
12. Moving and Renaming Files with mv
mv old.txt new.txt
mv report.txt /archive/
mv *.log /var/log/archive/
The same command is used both for renaming files and moving them to a different directory.
13. Removing Files with rm
rm file.txt
rm -i file.txt
rm -r directory
rm -rf temp_directory
14. Redirection and Pipes
Shell redirection sends command output to files or other commands instead of the terminal.
| Operator | Meaning |
|---|---|
| > | Redirect stdout to a file (overwrite). |
| >> | Append stdout to a file. |
| 2> | Redirect stderr to a file. |
| 2>&1 | Send stderr to the same place as stdout. |
| | | Pipe stdout into another command. |
The tee command is not a redirection operator. It reads stdin and writes it both to a file and to stdout, which is useful when you want a saved copy and still want to see the output:
ls -l > listing.txt
echo "error" >> app.log
grep ERROR /var/log/syslog 2> errors.txt
df -h | tee disk-report.txt
15. Viewing Files with cat, less, and tail
cat displays the contents of text files. Large log files should be viewed with less because it loads data page by page.
| Command | Purpose |
|---|---|
| head | First 10 lines by default. |
| tail | Last 10 lines by default. |
| tail -f | Monitor a growing log file in real time. |
16. Searching via find and locate
The find command searches directories based on name, type, size, and modifications.
find /etc -name sshd_config
find . -name "*.log"
The locate command searches a prebuilt filename database. On many distributions the database tools come from plocate or the older mlocate package (whichever your distro ships). Update the database with updatedb before relying on locate results.
sudo updatedb
locate sshd_config
17. Hard Links vs Symbolic Links
| Feature | Hard Link | Symbolic Link |
|---|---|---|
| Shares inode | Yes | No |
| Cross filesystem | No | Yes |
| Can link directories | No | Yes |
| Breaks if source removed | No | Yes |
ln file1 hardlink1
ln -s /etc/ssh/sshd_config sshd_config_link
18. Inspecting Files with stat and file
The stat command displays detailed metadata including permissions, inode, timestamps and ownership. The file command determines the actual file type instead of relying on the filename extension.
$ stat /etc/hostname
File: /etc/hostname
Size: 12 Blocks: 8 IO Block: 4096 regular file
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
$ file /bin/ls
/bin/ls: ELF 64-bit LSB pie executable, x86-64, ...
19. Disk Usage Commands (df, du)
Use df -h to check free and used space on mounted filesystems. Use du -sh to determine which directories consume the most storage.
$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 50G 32G 16G 67% /
$ du -sh /var/log
248M /var/log
$ du -sh /var/log/* | sort -h | tail -5
12M /var/log/journal
80M /var/log/syslog
Commands Covered in This Chapter
pwd- Print working directorycd- Change directoryls- List directory contentstouch- Create empty file or update timestampmkdir- Create directoriescp- Copy files and directoriesmv- Move/rename files and directoriesrm- Remove files and directoriestee- Write stdin to a file and to stdoutcat- Concatenate and display filesless- View file contents page by pagehead- Display first lines of filetail- Display last lines of filefind- Search for files in directory hierarchylocate/updatedb- Search a filename database (plocate or mlocate)ln- Create hard and symbolic linksstat- Display file metadatafile- Determine file typedu- Estimate file space usagedf- Report filesystem disk space usage
Real Production Scenario: Locating Log Files
Scenario: Your web application is throwing 500 errors. You need to find recent error logs.
Log locations differ by distribution and service. Traditional syslog-style messages often appear in /var/log/syslog (Debian/Ubuntu) or /var/log/messages (many RHEL-family systems); on systemd hosts, journalctl is the primary interface. Apache logs are commonly under /var/log/apache2/ on Debian/Ubuntu and /var/log/httpd/ on RHEL-family systems.
cd /var/log
ls -lht | head
# Debian/Ubuntu Apache example:
tail -n 50 /var/log/apache2/error.log
# RHEL-family Apache (httpd) example:
# tail -n 50 /var/log/httpd/error_log
# Recent systemd journal entries:
# journalctl -u apache2 -n 50 # or -u httpd
find /var/log -type f -mtime -1 -name "*.log"
This workflow is used daily by production SREs and sysadmins to troubleshoot live issues.