Linux File System Hierarchy (FHS) Explained: /etc, /var, /usr, /proc and More

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a big housing society

Why do we need this?

In a housing society in Kothrud there is one main gate. Inside, the office keeps rules and records. The parking holds vehicles. Each flat belongs to one family. The store room holds shared tools. Nobody keeps cars in the office.

What is it?

Main gate = /. Office with rules = /etc. Records that keep growing = /var. Flats = /home/. Shared tools = /usr/bin. Outside contractors = /opt. Guest room cleaned daily = /tmp. Electric meter board (live readings) = /proc and /sys.

How to do it (step by step)

2. The root / and the FHS standard

Why do we need this?

If every distro put files in random places, no script or person could work across servers. A shared map is needed.

What is it?

The Filesystem Hierarchy Standard (FHS) says which top folder holds what. Everything starts at /. Note: / is the root of the tree. /root is the home folder of the root user. They are different.

How to do it (step by step)

1. List the top of the tree.

ls /

Output:

bin  boot  dev  etc  home  lib  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

What it means: These are the standard FHS folders.

2. See it as a tree one level deep.

tree -L 1 /

Output:

/
├── bin -> usr/bin
├── boot
├── etc
...

What it means: bin is a link to usr/bin on new distros.

3. Read the built-in manual on the layout.

man hier

Output:

HIER(7)  Linux Programmer's Manual
NAME  hier - description of the filesystem hierarchy

What it means: man hier explains each folder.

3. /etc: the configuration office

Why do we need this?

You change how a service behaves by editing its config. You must know where configs live.

What is it?

/etc holds text config files for the system and services: users (/etc/passwd), groups, hosts, DNS (/etc/resolv.conf), mounts (/etc/fstab), SSH, cron, nginx and more. No binaries go here.

How to do it (step by step)

1. See the user list file.

head -3 /etc/passwd

Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin

What it means: Each line: user, UID, GID, home, shell.

2. See the local name lookup file.

cat /etc/hosts

Output:

127.0.0.1 localhost
10.0.1.20 db01.internal db01

What it means: db01 resolves to 10.0.1.20 without DNS.

3. See DNS servers.

cat /etc/resolv.conf

Output:

nameserver 127.0.0.53
search ap-south-1.compute.internal

What it means: DNS goes to the local resolver first.

4. Back up a config before editing.

sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%F)

What it means: A dated copy lets you roll back.

4. /var: data that keeps changing

Why do we need this?

Logs and caches grow every minute. If they fill the disk, services crash. You must know where to look.

What is it?

/var (variable) holds /var/log (logs), /var/cache (package caches), /var/lib (state of apps and databases, like /var/lib/mysql and /var/lib/docker), /var/spool (print and mail queues) and /var/www (web files on many distros).

How to do it (step by step)

1. See the log folder.

ls /var/log

Output:

auth.log  cloud-init.log  dpkg.log  journal  nginx  syslog

What it means: auth.log = logins. syslog = general. nginx = web logs.

2. Find which /var folder is biggest.

sudo du -sh /var/* 2>/dev/null | sort -h | tail -3

Output:

120M /var/cache
1.1G /var/log
6.4G /var/lib

What it means: /var/lib is biggest (Docker or a database).

3. Follow a log live.

sudo tail -f /var/log/nginx/access.log

Output:

10.0.0.5 - - [25/Oct/2026:10:40:01 +0530] "GET / HTTP/1.1" 200 612

What it means: Each new request appears. Ctrl+C to stop.

5. /home, /root, /usr, /opt, /tmp

Why do we need this?

You need to know where your own files go, where programs are installed and where it is safe to put scratch files.

What is it?

/home/ is each user's space; ~ is a short name for it. /usr holds programs installed by the package manager (/usr/bin, /usr/lib, /usr/share). /usr/local is for things you compile yourself. /opt is for big vendor apps. /tmp is shared scratch space, often cleared at reboot.

How to do it (step by step)

1. Go home and print where you are.

cd ~ && pwd

Output:

/home/meera

What it means: ~ means /home/meera for user meera.

2. Find where a program is installed.

command -v nginx

Output:

/usr/sbin/nginx

What it means: Package-installed admin tools go to /usr/sbin.

3. Check /tmp permissions (sticky bit).

ls -ld /tmp

Output:

drwxrwxrwt 18 root root 4096 Oct 25 10:00 /tmp

What it means: t at the end = sticky bit. Everyone can write, but only owners can delete their own files.

4. Make a safe temp file.

mktemp

Output:

/tmp/tmp.k3J9aQ2xZb

What it means: A unique name avoids clashes with other users.

6. /dev: devices as files

Why do we need this?

Linux treats almost everything as a file. Disks, terminals and even 'nothing' have a file name. Tools can read and write them like normal files.

What is it?

/dev holds device files: /dev/sda or /dev/nvme0n1 (disks), /dev/sda1 (partition), /dev/tty (terminal), /dev/null (a black hole), /dev/zero (endless zeros), /dev/random and /dev/urandom (random bytes).

How to do it (step by step)

1. List block devices.

lsblk

Output:

NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
nvme0n1     259:0    0   20G  0 disk
└─nvme0n1p1 259:1    0   20G  0 part /
nvme1n1     259:2    0  100G  0 disk /data

What it means: Two disks. The second is mounted at /data.

2. Throw away output with /dev/null.

ls /nope 2>/dev/null; echo done

Output:

done

What it means: The error went into the black hole.

3. Create a 100 MB test file from /dev/zero.

dd if=/dev/zero of=/tmp/test.img bs=1M count=100

Output:

100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 0.1 s

What it means: Useful for disk speed tests.

7. /proc and /sys: live windows into the kernel

Why do we need this?

You want CPU info, memory, process details and kernel settings without special tools.

What is it?

/proc and /sys are virtual. Nothing is on disk; the kernel makes the content when you read it. /proc has one folder per process (/proc/) plus files like cpuinfo, meminfo, loadavg. /proc/sys holds tunable settings (sysctl). /sys shows devices, drivers and power in a tree.

How to do it (step by step)

1. CPU model.

grep -m1 'model name' /proc/cpuinfo

Output:

model name : Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz

What it means: Read straight from the kernel.

2. Free memory.

grep -E 'MemTotal|MemAvailable' /proc/meminfo

Output:

MemTotal:        3969436 kB
MemAvailable:    3101220 kB

What it means: About 3 GB of 4 GB is available.

3. Look inside a process folder.

cat /proc/1/comm; ls -l /proc/self/cwd

Output:

systemd
lrwxrwxrwx 1 meera meera 0 Oct 25 10:45 /proc/self/cwd -> /home/meera

What it means: Process 1 is systemd. self = the current process.

4. Read and change a kernel setting.

cat /proc/sys/net/ipv4/ip_forward; sudo sysctl -w net.ipv4.ip_forward=1

Output:

0
net.ipv4.ip_forward = 1

What it means: IP forwarding is now on (until reboot; save it in /etc/sysctl.d/ to keep it).

5. Check a disk's scheduler in /sys.

cat /sys/block/nvme0n1/queue/scheduler

Output:

[none] mq-deadline

What it means: The active value is in brackets.

8. Paths and mounts: how disks join the tree

Why do we need this?

A new 100 GB disk is useless until it appears somewhere in the tree.

What is it?

An absolute path starts with / (like /var/log/syslog). A relative path starts from where you are (like logs/app.log). . is here, .. is one up. Mounting attaches a disk's file system to a folder (a mount point). /etc/fstab makes mounts permanent.

How to do it (step by step)

1. Relative path walk.

cd /var/log && cd ../lib && pwd

Output:

/var/lib

What it means: From /var/log, .. goes to /var, then into lib.

2. See what is mounted where.

findmnt -t ext4,xfs

Output:

TARGET SOURCE         FSTYPE OPTIONS
/      /dev/nvme0n1p1 xfs    rw,noatime
/data  /dev/nvme1n1   ext4   rw,relatime

What it means: Root is xfs. /data is a separate ext4 disk.

3. Mount a new disk.

sudo mkfs.ext4 /dev/nvme2n1 && sudo mkdir -p /backup && sudo mount /dev/nvme2n1 /backup && df -h /backup

Output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme2n1     50G   24K   47G   1% /backup

What it means: The disk now lives at /backup.

4. Make it permanent with UUID.

echo "UUID=$(sudo blkid -s UUID -o value /dev/nvme2n1) /backup ext4 defaults,nofail 0 2" | sudo tee -a /etc/fstab && sudo mount -a

Output:

UUID=9b2e... /backup ext4 defaults,nofail 0 2

What it means: UUIDs do not change when disk names change.

9. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

10. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

11. Troubleshooting step by step

Why do we need this?

Most file-system issues are 'disk full', 'file not found' or 'mount failed'. Check them in this order.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Check free space per mount.

df -h

2. Check free inodes.

df -i

3. Find the biggest folders on that mount only.

sudo du -xh /var --max-depth=1 | sort -h

4. Find deleted files still held open.

sudo lsof +L1

5. Check the mount table.

findmnt

6. Compare fstab with real UUIDs.

blkid; cat /etc/fstab

12. Lab 1: Disk-full fire drill

Why do we need this?

At Leela Travels in Goa, the website stops. df shows / at 100%. Find and fix it.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Confirm.

df -h /

Output:

/dev/nvme0n1p1  20G   20G     0 100% /

2. Find the big folder.

sudo du -xh / --max-depth=1 2>/dev/null | sort -h | tail -3

Output:

1.9G /usr
2.4G /home
14G /var

3. Go deeper.

sudo du -xh /var --max-depth=2 | sort -h | tail -2

Output:

13G /var/log
13G /var/log/app

4. See the files.

ls -lhS /var/log/app | head -3

Output:

-rw-r--r-- 1 app app 12G Oct 25 10:50 debug.log

5. Empty it safely (the app keeps the file open).

sudo truncate -s 0 /var/log/app/debug.log

6. Verify.

df -h /

Output:

/dev/nvme0n1p1  20G  7.1G   13G  36% /

7. Prevent it: add logrotate.

printf '/var/log/app/*.log {\n daily\n rotate 7\n compress\n missingok\n copytruncate\n}\n' | sudo tee /etc/logrotate.d/app

13. Lab 2: Tour the tree like an auditor

Why do we need this?

Answer five audit questions using only FHS knowledge.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Which users can log in with a shell?

grep -v nologin /etc/passwd | cut -d: -f1

Output:

root
meera
ec2-user

2. Which DNS server is used?

grep nameserver /etc/resolv.conf

Output:

nameserver 10.0.0.2

3. Which vendor apps are installed?

ls /opt

Output:

aws  splunkforwarder

4. How many CPUs?

grep -c ^processor /proc/cpuinfo

Output:

2

5. Who logged in recently?

sudo grep 'Accepted' /var/log/auth.log | tail -2

Output:

Accepted publickey for meera from 49.36.10.4 port 51022 ssh2

14. Frequently asked questions

15. Interview questions and answers

Beginner level

Mid level level

Senior level

16. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.