// learn · linux · rhcsa · 8 min

Linux file system hierarchy.

Linux has a place for everything. Programs live in /usr, configuration lives in /etc, logs live in /var/log, user data lives in /home. Eight animated steps — one for each big directory — and you'll know where to look for any file.

Linux File System Hierarchy Standard (FHS) animated tour. Top-level directories: /home, /etc, /var, /usr, /tmp, /opt, /proc, /dev. Covers RHCSA EX200 exam objectives for filesystem layout.
// file system hierarchy

Linux organizes every file on the system under a single root directory called /. Below it sit a small number of well-known top-level directories — each with a specific job. Learn the eight big ones and you'll know where to look for anything.

// before you start
you should know
  • ·Comfortable using cd, ls, and cat at the shell (if not, do the Command Line lesson first)
  • ·Roughly what 'a file' and 'a directory' are
by the end you'll

Name the eight key top-level directories on a Linux system, say what each is for, and know which directory to look in for any common file.

pace: 8 minutes

filesystem tree — step 1 / 8 · /
/root/homeuser data/etcconfig/varlogs, data/usrprograms/tmptemp/prockernel info/devdevices/opt3rd-party

/ — the root of everything

Linux has exactly one root directory. Every path on the system, regardless of which disk or partition it physically lives on, starts here. When you mount a USB drive at /mnt/usb, that mount point is just a subdirectory of /. There is no separate C: or D: drive — it's all one tree.

// common contents
/home·user data
/etc·system configuration
/var·logs, mail, web roots — data that grows
/usr·installed programs and libraries
/tmp·temporary files
/proc·kernel and process info (not on disk)
/dev·device files (disks, terminals, /dev/null)
/opt·optional third-party software
// try these
$ls /
$tree -L 1 /
$df -h
// key insight

The standard is called the FHS (Filesystem Hierarchy Standard). It's why your script that reads /etc/passwd works the same on RHEL, Debian, Arch, and Alpine. Knowing the FHS basics turns "where do I look?" into "I know where to look" — and that's most of what makes a sysadmin productive.

// one-line summary · every top-level dir
/the root — everything lives below
/binessential commands (often symlink to /usr/bin)
/sbinessential admin commands (often → /usr/sbin)
/bootkernel images, initramfs, GRUB config
/devdevice files (disks, terminals, /dev/null)
/etcsystem-wide configuration
/homeregular user home directories
/libessential shared libs (often → /usr/lib)
/mediaauto-mount points for removable media
/mntmanual mount points (admin's playground)
/optoptional third-party software
/procvirtual: kernel + per-process info
/rootthe root user's home directory
/runruntime data — PIDs, sockets, locks (tmpfs)
/srvdata for services (rarely used in practice)
/sysvirtual: kernel devices, drivers, sysfs
/tmptemp files, often tmpfs, cleared periodically
/usrprograms + libraries from the package manager
/varvariable data — logs, mail, caches, web roots
// check yourself
4 quick questions
Q1

You need to read SSH server settings. Which directory holds the config?

Q2

A disk filled up overnight. What directory should you investigate first?

Q3

What's special about /proc?

Q4

You ran `cat report.txt > /dev/null`. What happened?

These aren't graded — they're just for active recall, which is what actually makes the lesson stick.

Read this lesson as text8 chapters · quiz answers

  1. 01/ — / — the root of everything

    Linux has exactly one root directory. Every path on the system, regardless of which disk or partition it physically lives on, starts here. When you mount a USB drive at /mnt/usb, that mount point is just a subdirectory of /. There is no separate C: or D: drive — it's all one tree.

    /home
    — user data
    /etc
    — system configuration
    /var
    — logs, mail, web roots — data that grows
    /usr
    — installed programs and libraries
    /tmp
    — temporary files
    /proc
    — kernel and process info (not on disk)
    /dev
    — device files (disks, terminals, /dev/null)
    /opt
    — optional third-party software
    • $ ls / — see what's at the root
    • $ tree -L 1 / — one level deep, visualized
    • $ df -h — what's mounted where

  2. 02/home — /home — user data

    Every user gets a directory here named after their login. This is where your documents, downloads, code, and dotfiles (config files starting with a .) live. Only the owning user can read it by default. The root user's home is special: it lives at /root, not /home/root.

    /home/alice
    — alice's entire personal world
    /home/alice/Documents
    — user documents
    ~/.bashrc
    — bash startup config (per-user)
    ~/.ssh/
    — SSH keys + known_hosts
    ~/.config/
    — modern app configs (XDG standard)
    /root
    — the root user's home (not /home/root!)
    • $ cd ~ — your home, shorthand
    • $ echo $HOME — where am I going with cd ~
    • $ ls -la ~ — see hidden dotfiles
    • $ du -sh /home/* — how much each user is using

  3. 03/etc — /etc — system-wide configuration

    If a service or the OS needs to be configured, its settings probably live in /etc. Almost everything here is a plain text file — easy to read, easy to edit with vim or nano, easy to put in git. The convention: machine-wide config goes here; per-user config goes in ~/.config or ~/.app-name.

    /etc/passwd
    — list of users (no actual passwords)
    /etc/shadow
    — password hashes (root-only)
    /etc/hostname
    — this machine's name
    /etc/fstab
    — what mounts where at boot
    /etc/ssh/
    — SSH server + client config
    /etc/systemd/
    — systemd unit files (admin)
    /etc/os-release
    — which distro and version
    /etc/cron.d/
    — system-scheduled jobs
    • $ cat /etc/os-release — what distro is this?
    • $ ls /etc | wc -l — lots of stuff — count it
    • $ grep -r ListenAddress /etc/ssh — search a service config

  4. 04/var — /var — variable data

    Anything that grows during normal operation lives here: logs that accumulate, databases that get bigger, caches that fill up, mail queues, the web server's content. The opposite of /etc and /usr — those are mostly static. /var is where you look when something fills up the disk.

    /var/log/
    — system + service logs
    /var/log/messages
    — general kernel + service log (RHEL)
    /var/log/secure
    — auth + sudo events (RHEL)
    /var/lib/
    — stateful data for services (e.g. databases)
    /var/www/
    — default web root (Apache, nginx)
    /var/spool/
    — queues — mail, print, cron
    /var/cache/
    — caches (yum/dnf metadata, fontconfig)
    /var/tmp/
    — tmp that survives reboot (vs /tmp)
    • $ tail -f /var/log/messages — watch the log live
    • $ du -sh /var/log/* — which logs are huge?
    • $ journalctl — systemd's modern log query

  5. 05/usr — /usr — programs and libraries

    Almost everything installed by your package manager (rpm, dnf, apt) lands in /usr. The 'usr' originally stood for 'user', but modern Linux uses it for programs that come WITH the system. /usr/bin holds the commands you type every day. /usr/lib holds the shared libraries those commands need. /usr/local is reserved for stuff you install manually (not from the package manager).

    /usr/bin/
    — most commands (ls, cat, python, git, ...)
    /usr/sbin/
    — system admin commands (mkfs, fdisk, ...)
    /usr/lib/
    — shared libraries (.so files)
    /usr/lib/systemd/
    — package-shipped systemd units
    /usr/share/
    — arch-independent data (man pages, icons)
    /usr/share/doc/
    — docs that ship with packages
    /usr/local/
    — stuff YOU installed (not via package mgr)
    • $ which python — where does this command live?
    • $ ls /usr/bin | wc -l — count of installed commands
    • $ rpm -ql nginx | head — files installed by a package

  6. 06/tmp — /tmp — temporary files

    Anyone can write here. On modern RHEL, /tmp is usually a tmpfs (in RAM, not on disk) — fast but vanishes on reboot. Even if it's on disk, systemd-tmpfiles cleans up files older than 10 days. The sticky bit (the t in drwxrwxrwt) means even though everyone can write here, you can only delete your OWN files.

    /tmp/
    — world-writable scratch space
    /tmp/.X11-unix/
    — X server sockets (GUI)
    /var/tmp/
    — longer-lived tmp (survives reboot)
    • $ ls -ld /tmp — see the sticky bit (the t)
    • $ df -h /tmp — is it tmpfs or on disk?
    • $ mktemp — create a unique tmp file

  7. 07/proc — /proc — virtual filesystem (kernel & processes)

    /proc isn't on any disk. The kernel generates its contents on the fly when you read from it. Every running process gets its own subdirectory named after its PID (/proc/1234/) where you can see what command it's running, what files it has open, what its environment is. Kernel-wide info lives at the top: /proc/cpuinfo, /proc/meminfo, /proc/cmdline.

    /proc/cpuinfo
    — every detail about the CPU(s)
    /proc/meminfo
    — memory + swap stats
    /proc/cmdline
    — kernel boot parameters
    /proc/uptime
    — seconds since boot + idle time
    /proc/<pid>/
    — one dir per running process
    /proc/<pid>/status
    — human-readable state
    /proc/<pid>/fd/
    — open file descriptors
    /proc/sys/
    — tunable kernel parameters (sysctl)
    • $ cat /proc/cpuinfo | grep 'model name' | head -1 — what CPU?
    • $ cat /proc/$$/status — info on the current shell
    • $ free -h — memory summary (reads /proc/meminfo)

  8. 08/dev — /dev — devices as files

    Linux treats every device as a file. Reading from /dev/sda reads from the first disk. Writing to /dev/tty1 prints on console 1. Writing to /dev/null silently discards data. Reading from /dev/urandom gives you random bytes forever. The udev daemon populates and updates /dev as hardware connects and disconnects.

    /dev/null
    — the bit bucket — writes discarded
    /dev/zero
    — reads return endless zero bytes
    /dev/urandom
    — reads return random bytes (crypto-safe)
    /dev/sda, /dev/nvme0n1
    — block devices (whole disks)
    /dev/sda1
    — partition 1 of /dev/sda
    /dev/mapper/vg-lv
    — LVM logical volumes
    /dev/tty1
    — first virtual console
    /dev/pts/
    — pseudo-terminals (ssh, terminal emulators)
    • $ ls /dev | head — see what's there
    • $ dd if=/dev/zero of=/tmp/blob bs=1M count=10 — make a 10MB file of zeros
    • $ head -c 16 /dev/urandom | xxd — 16 random bytes, hex
    • $ command > /dev/null 2>&1 — silence all output

Quiz — answers

You need to read SSH server settings. Which directory holds the config?
→/etc/sshSystem-wide configuration lives in /etc. SSH server config is /etc/ssh/sshd_config.
A disk filled up overnight. What directory should you investigate first?
→/var (especially /var/log) — that's where data grows/var holds anything that grows during operation. Logs in /var/log are the most common culprit. Use du -sh /var/* | sort -h to find the heavy hitters.
What's special about /proc?
→It's a virtual filesystem — the kernel generates its contents on the fly; nothing is on disk/proc and /sys are kernel windows. They let userspace read (and sometimes write) kernel state via the file API.
You ran cat report.txt > /dev/null. What happened?
→The contents were discarded — /dev/null silently eats anything written to it/dev/null is the universal discard. Common pattern: command 2>/dev/null silences error output you don't care about.
// more in linux

keep going — these pair well with what you just learned.

see all linux →
🛡️

SELinux contexts

Why Apache can't read your file. Watch the policy engine decide — and learn the workflow for fixing denials. RHCSA-ready.

8 min · interactiveopen →
⚡

Linux boot process

From power button to login prompt. Every stage in the chain — UEFI, GRUB, kernel, initramfs, systemd — with the rescue moves that save you. RHCSA-ready.

9 min · interactiveopen →
💾

LVM stacking

Layer-by-layer build of an LVM stack: disks → PVs → VG → LVs → filesystem. Then extend live and snapshot. RHCSA-ready.

8 min · interactiveopen →
back to RHCSA trackall lessons