Every Linux server you will ever log into has the same directory structure. /etc always holds configuration. /var/log always holds logs. /proc always shows running processes. This predictability is not accidental — it comes from the Filesystem Hierarchy Standard (FHS), a specification that every major Linux distribution follows.
When a Hotstar engineer gets paged at 2 AM because the streaming API is returning errors, they do not hunt for log files. They go straight to /var/log/app/ because that is where logs live. They check /etc/nginx/ for configuration because that is where config lives. Understanding the FHS means any Linux server is immediately familiar.
Why It Matters
The Linux filesystem is the foundation underneath everything a DevOps engineer manages. Container images are Linux filesystems packaged differently. Kubernetes mounts volumes at specific paths inside containers. Ansible manages files at specific paths on remote hosts. CI/CD scripts read from and write to specific directories.
Misunderstanding paths is the source of a surprising number of production issues: a deployment script that works locally but fails in CI because relative paths resolve differently, a cron job that cannot find a binary because /usr/local/bin is not in cron's PATH, a Dockerfile that references the wrong path and silently copies nothing.
Core Principles
The Filesystem Hierarchy Standard — what lives where:
/+----+-- bin/ Essential binaries (ls, cp, mv, bash)| +-- sbin/ System binaries (fdisk, iptables, sshd)| +-- etc/ Configuration files — all of them| +-- var/ Variable data (logs, databases, spool)| | +-- log/ Application and system logs| | +-- run/ PID files and runtime data| +-- tmp/ Temporary files (cleared on reboot)| +-- home/ User home directories| +-- root/ Root user home directory| +-- proc/ Virtual FS: live kernel and process data| +-- sys/ Virtual FS: kernel hardware interface| +-- dev/ Device files (disks, terminals, null)| +-- mnt/ Manual mount points| +-- media/ Auto-mount points (USB, CD)| +-- opt/ Optional/third-party software| +-- usr/ User programs| | +-- bin/ Non-essential binaries| | +-- lib/ Libraries| | +-- local/ Locally installed software| +-- lib/ Shared libraries+----+-- boot/ Kernel and bootloader filesAbsolute vs relative paths:
An absolute path starts from root (/) and is always unambiguous:
/etc/nginx/nginx.conf # always this exact file/var/log/app/error.log # always this exact file/home/deploy/.ssh/id_ed25519 # always this exact fileA relative path is resolved from the current working directory:
./deploy.sh # deploy.sh in current directory../config/app.yaml # config/app.yaml one level uplogs/error.log # logs/error.log in current directoryCOMMON MISTAKE / WARNING**Common Mistake:** Relative paths in scripts, cron jobs, and systemd units almost always cause failures because the working directory is not what you expect. Always use absolute paths in automation.
The /proc filesystem — reading live kernel data:
/proc is not a real filesystem on disk. The kernel generates its contents on demand. Every running process has a directory /proc/PID/ containing live information:
cat /proc/1/cmdline # command that started PID 1ls -la /proc/1234/fd/ # open file descriptors of PID 1234cat /proc/meminfo # live memory statisticscat /proc/cpuinfo # CPU informationcat /proc/sys/net/ipv4/ip_forward # current kernel parameter valueStep-by-Step Lab
Milestone 1 — Navigate the filesystem confidently
## Check where you arepwd## /home/youruser ## Go to root and explorecd /ls -la ## Go to etc and look at what is configuredcd /etcls -la | head -30 ## Use absolute path from anywherels -la /var/log/ ## Go home quicklycd ~ # or just: cdpwd## /home/youruser ## Go back to previous directorycd /etccd -## returns to /home/youruserMilestone 2 — List files with useful flags
## Long format with human-readable sizesls -lh /var/log/ ## Show hidden files (dotfiles)ls -la ~## .bashrc .ssh .profile are all hidden (start with .) ## Sort by modification time, newest firstls -lt /var/log/ ## Recursive listingls -R /etc/ssh/ ## Show directories onlyls -d /etc/*/Milestone 3 — Create, copy, move, and delete
## Create directoriesmkdir -p /tmp/lab/configs/nginx # -p creates intermediate dirs ## Create filestouch /tmp/lab/app.logtouch /tmp/lab/{file1,file2,file3}.txt # brace expansion creates 3 files ## Copycp /etc/hosts /tmp/lab/hosts.backupcp -r /etc/ssh/ /tmp/lab/ssh-backup/ # -r for directories ## Move (also used to rename)mv /tmp/lab/file1.txt /tmp/lab/renamed.txt ## Removerm /tmp/lab/file2.txtrm -r /tmp/lab/ssh-backup/ # -r for directories ## ALWAYS double-check before rm -rfrm -rf /tmp/lab/ # removes everything, no recoveryCOMMON MISTAKE / WARNING**Security:** `rm -rf` with a variable (`rm -rf $DIRNAME/`) is extremely dangerous. If the variable is empty, this becomes `rm -rf /`. Always quote and validate variables before using them in delete commands.
Milestone 4 — Find files efficiently
## Find by name (case sensitive)find /etc -name "nginx.conf" ## Find by name (case insensitive)find /var/log -iname "*.log" ## Find files modified in the last 24 hoursfind /var/log -mtime -1 -type f ## Find files larger than 100MBfind / -size +100M -type f 2>/dev/null ## Find files with specific permissionsfind /home -name ".ssh" -type d -perm 700 ## Find and execute a command on each resultfind /tmp -name "*.tmp" -mtime +7 -delete## Deletes .tmp files older than 7 days ## Faster search using index (update index first with: sudo updatedb)locate nginx.conf ## Find which binary a command useswhich python3## /usr/bin/python3 whereis nginx## nginx: /usr/sbin/nginx /etc/nginx /usr/share/man/man8/nginx.8.gzMilestone 5 — View file contents
## Print entire filecat /etc/hosts ## View large files page by page (q to quit, /pattern to search)less /var/log/syslog ## First 20 lineshead -n 20 /var/log/nginx/access.log ## Last 50 linestail -n 50 /var/log/nginx/error.log ## Follow a log file live (Ctrl+C to stop)tail -f /var/log/app/application.log ## Follow and show last 100 lines firsttail -f -n 100 /var/log/app/application.log ## View file infofile /bin/bash # shows: ELF 64-bit executablestat /etc/hosts # shows inode, size, timestamps, permissionsMilestone 6 — Check disk usage
## Disk space by filesystemdf -h## Filesystem Size Used Avail Use% Mounted on## /dev/xvda1 20G 12G 7.5G 62% / ## Disk usage of a directorydu -sh /var/log/## 2.3G /var/log/ ## Find the biggest directoriesdu -sh /var/* | sort -rh | head -10 ## Find largest files in /var/logfind /var/log -type f -exec du -sh {} + | sort -rh | head -10Milestone 7 — Work with links
## Create a symbolic link (soft link)ln -s /opt/app/current/bin/app /usr/local/bin/app## Now you can run 'app' from anywhere ## Update a symlink to point to new versionln -sf /opt/app/v2.0/bin/app /usr/local/bin/app## -f forces overwrite of existing link ## Create a hard linkln /etc/hosts /tmp/hosts-hardlink## Both point to same inode — same file, two names ## Read where a symlink pointsreadlink /usr/local/bin/app## /opt/app/current/bin/app ## Find broken symlinksfind /usr/local/bin -xtype l## Lists symlinks whose target does not existCommon Mistakes
| Mistake | Problem | Fix |
|---|---|---|
| Using relative paths in cron | Cron runs from /, relative paths break |
Always use absolute paths |
rm -rf with unquoted variable |
Variable empty = rm -rf / = disaster |
Quote vars, validate before delete |
Confusing /tmp with persistent storage |
/tmp is cleared on reboot |
Use /var/ for persistent data |
Editing files in /proc directly |
/proc is a virtual filesystem |
Use sysctl -w to change kernel params |
Troubleshooting
| Symptom | First Command | What to Look For |
|---|---|---|
| Disk full, cannot write files | df -h |
Filesystem at 100% Use% |
| Cannot find a file | find / -name filename 2>/dev/null |
Output shows path |
| Not sure which binary runs | which commandname |
Full path to binary |
| File exists but app cannot read it | ls -la filename |
Permission denied for relevant user |
| Symlink not working | readlink -f symlinkname |
Target path does not exist |
PLACEMENT PRO TIP**Tip:** `ls -lh` (lowercase L) is the most useful listing command in production. It shows permissions, owner, size in human-readable format, and modification time — everything you need to diagnose a file issue.
REMEMBER THIS**Remember:** `/proc` and `/sys` are virtual filesystems. They have no files on disk. The kernel generates their contents in memory on demand. Changes to `/proc/sys/` via `sysctl -w` are lost on reboot — make permanent changes in `/etc/sysctl.conf`.