This is a very practical topic and it shows up a lot in a real sysadmin life. Filesystem Hierarchy Standard (FHS) in Linux is something every Linux admin should have knowledge of. I tend to forget things very easy. So, after brewing a fine single origin specialty coffee from Latin America I put this practical tutorial together.
Linux File Hierarchy (FHS) and Finding Files
The FHS defines where files should go in Linux, so all distros are consistent. Here’s the essential map you need to know as a sysadmin.
| Directory | Purpose |
|---|---|
/ | Root of the filesystem, everything starts here. |
/bin | Essential user commands (ls, cp, mv, rm, cat). Available even if /usr isn’t mounted. |
/sbin | Essential system binaries (reboot, fsck, ip, mount). |
/boot | Kernel and bootloader files (vmlinuz, initramfs, grub/). |
/dev | Device files (/dev/sda, /dev/null, /dev/tty). |
/etc | System-wide configuration (/etc/passwd, /etc/ssh/sshd_config). |
/home | User home directories. |
/lib, /lib64 | Shared libraries needed by binaries in /bin and /sbin. |
/media | Mount point for removable media (USB, CD-ROM). |
/mnt | Temporary mount point for filesystems. |
/opt | Optional software (third-party apps, not from the distro). |
/proc | Virtual filesystem, process and kernel info (/proc/cpuinfo). |
/root | Root user’s home directory. |
/run | Runtime data since boot (like PID files, sockets). |
/srv | Data served by the system (e.g., websites /srv/www). |
/sys | Kernel objects and hardware info. |
/tmp | Temporary files (cleaned at reboot). |
/usr | User programs and libraries (non-essential at boot). |
/var | Variable data (logs in /var/log, spool, caches). |
Finding Files and Commands in Linux
You can locate commands. The below shows the path of a command in $PATH.
which ls
# /bin/lstype tells you if it’s an alias, shell builtin, or binary:
type ls
ls is aliased to `ls --color=auto'whereis gives binary + manpage location:
whereis bash
bash: /usr/bin/bash /usr/share/man/man1/bash.1.gz /usr/share/info/bash.info.gzLocate files
Find the SSH config file under /etc.
find /etc -name sshd_configUses a prebuilt database (fast, but may need updatedb):
locate passwdFind log files larger than 100 MB:
find /var/log -type f -size +100MIdentify which package provides a file
On Debian-based:
dpkg -S /bin/lsOn RedHat based:
rpm -qf /bin/lsLinux Sysadmin Rule of Thumb:
- Config files →
/etc - Logs →
/var/log - Binaries →
/bin,/usr/bin,/sbin,/usr/sbin - User data →
/home,/root - Temporary →
/tmp,/var/tmp - Device nodes →
/dev
I also put together the below table for the most used commands to find things in the Filesystem Hierarchy in Linux.
| Command | Scope | Checks Real FS? | Fast? | Use Case |
|---|---|---|---|---|
| find | Files anywhere | ✅ Yes | ❌ Slower | Deep, real-time search with conditions (size, time, perms) |
| locate | Files anywhere | ❌ Uses DB | ✅ Very fast | Quick search, less accurate if DB not updated |
| which | Executables in $PATH | ✅ Yes | ✅ Fast | Find which binary runs when typing command |
| whereis | Executable + manpages | ✅ Yes | ✅ Fast | Find binary + man page |
| type | Commands | ✅ Shell check | ✅ Fast | Identify alias, builtin, function, or binary |
It is important to know the Filesystem Hierarchy Standard (FHS) in Linux, including the file locations and directory classifications. Let me know what you think.